How to get all the arguments of a function using a query?

[powerthe900]

I have been reading the documentation, but I have not found any way to do this as per my knowledge. Is there a way to write a query that selects all the arguments of a function. Currently, I can just use .getArgument() and then get the information on one argument of the function. Is there a way to have a for loop or something that iterates over all the arguments and returns information.

[smowton]

CodeQL doesn't have loops. Instead functions can have multiple results -- you should think about it more like a database query language than a programming language.

For example, the query

from Call c, int i
select c.getArgument(i), i

if there was one call in the program, A.f("hello", "world"), would produce results

"hello" | 0
"world" | 1

There's also getAnArgument(), which produces one result for each argument of the given Call, and is equivalent to getArgument(_).

[powerthe900]

This works. I have one more question to add onto this.
Currently, this is how I test if the argument is not a struct. How would I do this for all of the arguments?
v = f.getParameter(0) and not (v.getUnspecifiedType() instanceof Struct) and not (v.getUnspecifiedType().(PointerType).getBaseType+().getUnspecifiedType() instanceof Struct)
v is variable
and f is function

[powerthe900]

Also, this gets the arguments of function calls. Is there a way to do this for functions only, not calls?

[smowton]

It looks like you're dealing with C/C++? In which case:

All function parameters:

from Function f
select f.getAParameter()

and

All non-struct-typed parameters:

Type getParameterBaseTypeRec(Parameter p, Type acc) {
  if acc instanceof PointerType
  then result = getParameterBaseTypeRec(p, acc.(PointerType).getBaseType().getUnspecifiedType())
  else result = acc
}

Type getParameterBaseType(Parameter p) {
  result = getParameterBaseTypeRec(p, p.getUnspecifiedType())
}

from Function f, Parameter p, Type baseType
where baseType = getParameterBaseType(p)
and not baseType instanceof Struct
select f, p

Note I've written a supporting function so we can use getUnspecifiedType every time we look through a base type (I think this is necessary, as I believe getUnspecifiedType only resolves typedefs at the top level, but I could be wrong as I don't usually work with C/C++)

You could probably also get this by

Type lookThroughPointer(Type t) {
  result = t.(PointerType).getBaseType().getUnspecifiedType()
}

Type getBaseType(Type t) {
  result = lookThroughPointer+(t)
}

from Function f, Parameter p, Type baseType
where baseType = lookThroughPointer+(p)
and not baseType instanceof Struct
and not baseType instanceof PointerType
select f, p

However this is worse style because evaluating this might calculate getBaseType and lookThroughPointer for all types in the program, not just starting at Parameter types: we're relying on the compiler to work that out for us in this case.

[powerthe900]

The first query works. I have left the second query running both on my machine and my pc with a small codebase. It takes forever still.

[smowton]

Is the one taking a long time the second or the third query I wrote? Is the codebase in a public repo?

[powerthe900]

It is the second query. Here is a public query I ran on just nginx:
https://lgtm.com/query/4489480072568774822/

[smowton]

Doh, sorry, I had completely the wrong idea of how that accumulator idea would evaluate. I also forgot to bind Parameter p to Function f in any way. Try instead:

import cpp

Type getParameterTypeElement(Parameter p) {
  result = p.getUnspecifiedType()
  or
  result = getParameterTypeElement(p).(PointerType).getBaseType().getUnspecifiedType()
}

Type getParameterBaseType(Parameter p) {
  result = getParameterTypeElement(p) and not result instanceof PointerType
}

from Function f, Parameter p, Type baseType
where p = f.getAParameter() and
baseType = getParameterBaseType(p)
and not baseType instanceof Struct
select f, p

[powerthe900]

This works very well thank you!

[powerthe900]

There was one problem I came up. When running the new query, it still holds onto cases when there are other structs in the function.
For example, if there was a function named foo defined like this
int foo (struct lemon, char * test)
The query will still return foo, char * test when it shouldn't.
Is there a way for the query to not hold the function if any of the arguments are structs.

[smowton]

Yep, this wants the exists quantifier:

import cpp

Type getParameterTypeElement(Parameter p) {
  result = p.getUnspecifiedType()
  or
  result = getParameterTypeElement(p).(PointerType).getBaseType().getUnspecifiedType()
}

Type getParameterBaseType(Parameter p) {
  result = getParameterTypeElement(p) and not result instanceof PointerType
}

from Function f
where not exists(Parameter p | p = f.getAParameter() | getParameterBaseType(p) instanceof Struct)
select f

Or more briefly, not getParameterBaseType(f.getAParameter()) instanceof Struct