CodeQL library for C/C++
codeql/cpp-all 2.0.2-dev (changelog, source)
Search

Module DataFlowPrivate

Import path

import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate

Imports

Cached
IndirectInstructions
IndirectOperands
IsUnreachableInCall
NodeStars

A module for calculating the number of stars (i.e., *s) needed for various dataflow node toString predicates.

Predicates

additionalLambdaFlowStep

Extra data-flow steps needed for lambda flow analysis.

allowParameterReturnInSelf

Holds if flow is allowed to pass from parameter p and back to itself as a side-effect, resulting in a summary from p to itself.

clearsContent

Holds if values stored inside content c are cleared at node n.

compatibleTypes

Holds if t1 and t2 are compatible, that is, whether data can flow from a node of type t1 to a node of type t2.

expectsContent

Holds if the value that is being tracked is expected to be stored inside content c at node n.

forceHighPrecision

Holds if access paths with c at their head always should be tracked at high precision. This disables adaptive access path precision for such access paths.

getAUse

Gets a use of the instruction instr that is not ignored for dataflow purposes.

getAnOutNode

Gets a node that can read the value returned from call with return kind kind.

getContentApprox

Gets an approximated value for content c.

getInstructionType

Gets the type of the instruction instr.

getMaxElementContentIndirectionIndex

Gets the maximum number of indirections to use for ElementContent.

getMinIndirectionsForType

Returns the smallest indirection for the type t.

getNodeType

Gets the type of n used for type pruning.

getOperandType

Gets the type of the operand op.

getSecondLevelScope

Gets the second-level scope containing the node n, if any.

instructionForFullyConvertedCall

Gets the instruction that represents the first use of the value of call following a sequence of conversion-like instructions.

isArgumentNode

Holds if arg is an ArgumentNode of c with position pos.

isParameterNode

Holds if p is a ParameterNode of c with position pos.

jumpStep

Holds if data can flow from node1 to node2 in a way that loses the calling context. For example, this would happen with flow through a global or static variable.

knownSinkModel
knownSourceModel
lambdaCall

Holds if call is a lambda call of kind kind where receiver is the lambda expression.

lambdaCreation

Holds if creation is an expression that creates a lambda of kind kind for c.

localMustFlowStep
neverSkipInPathGraph
nodeGetEnclosingCallable

Gets the callable in which this node occurs.

nodeHasInstruction
nodeHasOperand
nodeIsHidden

Holds if n should be hidden from path explanations.

operandForFullyConvertedCall

Gets the operand that represents the use of the value of call following a sequence of conversion-like instructions, if a unique operand exists.

readStep

Holds if data can flow from node1 to node2 via a read of f. Thus, node1 references an object with a field f whose value ends up in node2.

simpleOutNode

Holds if node represents the output node for call.

storeStep

Holds if data can flow from node1 to node2 via an assignment to f. Thus, node2 references an object with a field f that contains the value of node1.

storeStepImpl

Holds if data can flow from node1 to node2 via an assignment to f. Thus, node2 references an object with a field f that contains the value of node1.

typeStrongerThan
validParameterAliasStep

Holds if the data-flow step from node1 to node2 can be used to determine where side-effects may return from a callable. For C/C++, this means that the step from node1 to node2 not only preserves the value, but also preserves the identity of the value. For example, the assignment to x that reads the value of *p in cpp int* p = ... int x = *p; does not preserve the identity of *p.

Classes

ArgumentNode

A data flow node that occurs as the argument of a call and is passed as-is to the callable. Instance arguments (this pointer) and read side effects on parameters are also included.

CastNode

A node that performs a type cast.

ContentApprox

An approximated Content.

DataFlowCall

A function call relevant for data flow. This includes calls from source code and calls inside library callables with a flow summary.

DataFlowCallable

A callable, which may be: - a function (that may contain code) - a summarized function (that may contain only FlowSummaryNodes) - a variable (this is used as context for global initialization, and also for the mid-point in interprocedural data flow between a write and read of a global variable in different functions). When flow crosses from one enclosing callable to another, the interprocedural data-flow library discards call contexts and inserts a node in the big-step relation used for human-readable path explanations.

DataFlowSecondLevelScope

A second-level control-flow scope in a switch or a chained if statement.

DataFlowType
DirectPosition
GlobalLikeVariable

A variable that behaves like a global variable.

IndirectionPosition
InstructionNode0

An instruction, viewed as a node in a data flow graph.

Node0Impl

A cut-down DataFlow::Node class that does not depend on the output of SSA. This can thus be safely used in the SSA computations themselves, as well as in construction of other node classes (TIRDataFlowNode).

NormalReturnKind

A value returned from a callable using a return statement, that is, a “normal” return.

OperandNode0

An operand, viewed as a node in a data flow graph.

OutNode

A data flow node that represents the output of a call (for example, a return value) at the call site.

Position
ReturnIndirectionNode
ReturnKind

A return kind. A return kind describes how a value can be returned from a callable. For C++, this is simply a function return.

ReturnNode

A data flow node that occurs as the result of a ReturnStmt.

SourceCallable

A source callable, conceptually, a function in the source code for the purpose of computing data flow. In practice this excludes functions that are summarized using models-as-data (as we don’t want to create unmodeled flows or duplicate paths), and includes variables (for reasons explained in DataFlowCallable).

SummarizedCallable

A summarized callable, that is, a function synthesized from one or more models-as-data models as a place to contain the corresponding FlowSummaryNodes.

SummaryArgumentNode

An argument node that is part of a summary. These only occur when the summary contains a synthesized call.

SummaryCall

A synthesized call inside a callable with a flow summary.

Datatypes

Modules

IsUnreachableInCall
IteratorFlow

Module that defines flow through iterators. For example, cpp auto it = v.begin(); *it = source(); ... sink(v[0]);

NodeStars

A module for calculating the number of stars (i.e., *s) needed for various dataflow node toString predicates.

Aliases

ArgumentPosition

An argument position represented by an integer.

DataFlowExpr

A C/C++ expression.

LambdaCallKind

The trivial type with a single element.

ParameterPosition

A parameter position represented by an integer.