C++: IR dataflow through modeled functions#2703
Conversation
|
Does |
|
These changes that you're copying from |
It should, since it doesn't use
Yes. I'll rewrite to remove that conflation where we have side effect instructions for both (return values and qualifiers don't currently have side effect instructions.) |
| private predicate modelFlowToParameter(Function f, int parameterIn, int parameterOut) { | ||
| exists(FunctionInput modelIn, FunctionOutput modelOut | | ||
| f.(DataFlowFunction).hasDataFlow(modelIn, modelOut) and | ||
| (modelIn.isParameter(parameterIn) or modelIn.isParameterDeref(parameterIn)) and | ||
| modelOut.isParameterDeref(parameterOut) | ||
| ) | ||
| } | ||
|
|
||
| private predicate modelFlowToReturnValue(Function f, int parameterIn) { | ||
| // Data flow from parameter to return value | ||
| exists(FunctionInput modelIn, FunctionOutput modelOut | | ||
| f.(DataFlowFunction).hasDataFlow(modelIn, modelOut) and | ||
| (modelIn.isParameter(parameterIn) or modelIn.isParameterDeref(parameterIn)) and | ||
| (modelOut.isReturnValue() or modelOut.isReturnValueDeref()) | ||
| ) |
There was a problem hiding this comment.
I can't find any callers of these two private predicates
| exists(int indexIn | | ||
| modelTaintToReturnValue(call.getStaticCallTarget(), indexIn) and | ||
| i1 = getACallArgumentOrIndirection(call, indexIn) | ||
| i1 = DataFlow::getACallArgumentOrIndirection(call, indexIn) |
There was a problem hiding this comment.
It looks like there's no longer a need to copy this predicate to DataFlowUtil.qll after your latest changes.
2 participants
No description provided.