Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

C++: Model Microsoft's "Active Template Library" #18136

Open
wants to merge 39 commits into
base: main
Choose a base branch
from

Conversation

MathiasVP
Copy link
Contributor

@MathiasVP MathiasVP commented Nov 27, 2024

This PR adds MaD models for most of the relevant classes in Active Template Library (ATL).

In addition I've also added ATL flow sources whenever I came across something relevant.

There are still some models that could do with more MaD rows, but they depend on a couple of features that aren't yet available. In particular:

  • It's not currently possible to add a MaD row for a templated conversion operator. i.e.:
      template<typename T>
      struct MyStruct {
          operator T();
      };
    because the name of the conversion operator is just whatever name T is instantiated with. You can see an example of where this is used here (where you'd like taint from this to the result of the call). A natural way to write this MaD would be:
    ["", "CAtlFileMapping<T>", True, "operator T *", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
    However, we don't currently allow using template arguments in the "name" column like we do for the signature column. I plan on tackling this as a follow-up to this PR.
  • Lots of container related models contains code allows you to do stuff like:
    Container container;
    POS pos = container.find(myValue);
    sink(container.lookup(pos));
    we could add a taint-step from find to the return value, and a taint-step from lookup's argument to its return value, in order to get this taint. However, I would much rather do the very small addition to dataflow (that Java has) which adds a MapKey content to express that "this is a key that points to something tainted". So that's another follow-up from this PR.

In addition to adding a bunch of models, this PR also fixes two problems in our interpretation of MaD rows:

  • It was impossible to add non-templated models since we were using isConstructedFrom in a few places to obtain the uninstantiated template of classes and functions. The problem with that is that isConstructedFrom doesn't have a result when the function/class isn't a template instantiation. So I fixed that as part of this work, and you can see the effect of this in the commit that follows the fix.
  • As I mentioned offline, a conversion operator such as:
      using MyInt = int;
      struct S {
        operator MyInt();
      };
    gets the name operator int instead of operator MyInt. So without some special handling a MaD row for operator MyInt would have to use the name operator int which is slightly confusing. So I added special handling of conversion operators so that we get the name operator MyInt instead. The effect of this can also be seen in the commit that follows the fix.

Commit-by-commit review highly encouraged. There is a lot of code, but most of it is just adding tests and models. Every commit can be read and understood in isolation!

@github-actions github-actions bot added the C++ label Nov 27, 2024
@MathiasVP MathiasVP marked this pull request as ready for review November 27, 2024 18:14
@MathiasVP MathiasVP requested a review from a team as a code owner November 27, 2024 18:14
@MathiasVP
Copy link
Contributor Author

Nothing exciting to see in DCA (I doubt that we have any projects on there which uses ATL)

Comment on lines 437 to 447
private predicate isClassConstructedFrom(Class c, Class templateClass) {
c.isConstructedFrom(templateClass)
or
not any(Class c_).isConstructedFrom(templateClass) and c = templateClass
}

private predicate isFunctionConstructedFrom(Function f, Function templateFunc) {
f.isConstructedFrom(templateFunc)
or
not any(Function f_).isConstructedFrom(templateFunc) and f = templateFunc
}
Copy link
Contributor Author

@MathiasVP MathiasVP Nov 27, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: I accidentially introduced a bug that meant that we matched too much here. This has been fixed in 3c0af49. I could've force-pushed it to clean the history, but I didn't want to rewrite the history since I've already marked it as ready for review.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant