codeql icon indicating copy to clipboard operation
codeql copied to clipboard

C++: Provide an initial SSA definition of the address of a variable

Open MathiasVP opened this issue 1 year ago • 0 comments
trafficstars

This PR fixes a subtle problem in the C++ SSA. Consider an example such as:

void test() {
  int x;
  sink(&x);
}

a basic requirement for SSA is that any use of a variable should be dominated by its definition. For the value of x this holds because the IR inserts an UninitializedInstruction providing the initial value of x. However, the address of x isn't initialized by this instruction, and so there's no initial definition of the address of x. When you're starting flow at a use of x which didn't have an implicit lvalue-to-rvalue conversion this meant that you didn't get flow out of that expression. Consider, for example, this example:

struct S { int x; };
void test() {
  S s;
  s.x = 0;
  sink(&s);
}

The qualifier of s.x doesn't have an lvalue-to-rvalue conversion, so you're writing node.asExpr() = any(FieldAccess fa).getQualifier() you're selecting the address of s, and since the address of s didn't have an initial SSA definition, you'd not get flow out of s.x and into &s.

This PR fixes this issue by providing an initial SSA definition of the SSA variable that represents the address.

Commit-by-commit review recommended. Most of the changes are basic refactorings, and really the meat of the change is in https://github.com/github/codeql/commit/cf162aa41240ccb9bd7ae39c2c6c068a4b3644eb

MathiasVP avatar Mar 07 '24 02:03 MathiasVP