-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
C++: Model Microsoft's "Active Template Library" #18136
base: main
Are you sure you want to change the base?
Conversation
…icitly handle the case where the function (or class) is not a template.
6188730
to
0242874
Compare
Nothing exciting to see in DCA (I doubt that we have any projects on there which uses ATL) |
… They all look good.
private predicate isClassConstructedFrom(Class c, Class templateClass) { | ||
c.isConstructedFrom(templateClass) | ||
or | ||
not any(Class c_).isConstructedFrom(templateClass) and c = templateClass | ||
} | ||
|
||
private predicate isFunctionConstructedFrom(Function f, Function templateFunc) { | ||
f.isConstructedFrom(templateFunc) | ||
or | ||
not any(Function f_).isConstructedFrom(templateFunc) and f = templateFunc | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Note: I accidentially introduced a bug that meant that we matched too much here. This has been fixed in 3c0af49. I could've force-pushed it to clean the history, but I didn't want to rewrite the history since I've already marked it as ready for review.
This PR adds MaD models for most of the relevant classes in Active Template Library (ATL).
In addition I've also added ATL flow sources whenever I came across something relevant.
There are still some models that could do with more MaD rows, but they depend on a couple of features that aren't yet available. In particular:
T
is instantiated with. You can see an example of where this is used here (where you'd like taint fromthis
to the result of the call). A natural way to write this MaD would be:["", "CAtlFileMapping<T>", True, "operator T *", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
Container container; POS pos = container.find(myValue); sink(container.lookup(pos));
find
to the return value, and a taint-step fromlookup
's argument to its return value, in order to get this taint. However, I would much rather do the very small addition to dataflow (that Java has) which adds aMapKey
content to express that "this is a key that points to something tainted". So that's another follow-up from this PR.In addition to adding a bunch of models, this PR also fixes two problems in our interpretation of MaD rows:
isConstructedFrom
in a few places to obtain the uninstantiated template of classes and functions. The problem with that is thatisConstructedFrom
doesn't have a result when the function/class isn't a template instantiation. So I fixed that as part of this work, and you can see the effect of this in the commit that follows the fix.operator int
instead ofoperator MyInt
. So without some special handling a MaD row foroperator MyInt
would have to use the nameoperator int
which is slightly confusing. So I added special handling of conversion operators so that we get the nameoperator MyInt
instead. The effect of this can also be seen in the commit that follows the fix.Commit-by-commit review highly encouraged. There is a lot of code, but most of it is just adding tests and models. Every commit can be read and understood in isolation!