C++: Add 'unsafe use of this' query by MathiasVP · Pull Request #4644 · github/codeql

MathiasVP · 2020-11-10T14:06:34Z

Fixes https://github.com/github/codeql-c-analysis-team/issues/163.

A couple of points are worth making:

I've restricted the scope of the query to just be uses of this in C++ constructors (as suggested in the discussion).
I've restricted the flow to be 'must' dataflow.

Since this is 'must' flow, I've designed a tiny ad-hoc 'must' dataflow library in the query. I suspect we could move this ad-hoc library out into a library file and generalize it if it turns out to be useful somewhere else.

I've specialized the query to only flag calls will cause undefined behavior, and not flag somewhat suspicious uses of calls to pure virtual in constructors that will actually resolve correctly to a function.

For instance, this will not be flagged:

struct Base { virtual void f() = 0; };

struct Derived : public Base {
  Derived() { f(); }

  void f() override {}
};

since the call to f in Derived's constructor will call f. However, the query does flag this:

struct Base { virtual void f() = 0; };

struct Derived : public Base {
  Derived() { call_f(this); }

  void f() override {}
};

void call_f(Base* b) { b->f(); }

since this is undefined behavior (and in practice will crash on the compilers I've tried).

I'm open to discussion on whether or not we want to flag the first example. It should only make the implementation simpler.
We do find some results on LGTM even though we throw away the somewhat benign cases: https://lgtm.com/query/3109442847251804192/.

TODO:

Write qhelp.
Check whether we need to add any CVE tags.

geoffw0

Couple of comments.

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>

…to unsafe-use-of-this-query

Co-authored-by: Jonas Jensen <jbj@github.com>

…RBlock.

…flowsFromSource.

…t-dominance removes some results. Second, that a cast to the pure virtual function's defining class (skipping past a derived class that overrides the function) followed by a call to the function still results in an alert. This is also undefined behavior.

…to unsafe-use-of-this-query

- Remove post-dominance requirement. It was really just hiding good results. - Fix test annotations. Turns out Clang and GCC's 'undefined behavior' warning didn't align with the C++ standard.

jbj · 2020-11-13T14:54:58Z

The code LGTM now! Next steps include qhelp, CPP-Differences and another round of checking the query on lgtm.com.

MathiasVP · 2020-11-16T10:45:58Z

The code LGTM now! Next steps include qhelp, CPP-Differences and another round of checking the query on lgtm.com.

I've added qhelp in 020af1c. Here's a fresh LGTM run: https://lgtm.com/query/3939119318730344544/. Removing the post-dominance gave quite a lot of new results that I'm still going through.

Co-authored-by: hubwriter <hubwriter@github.com>

MathiasVP · 2020-11-19T09:44:48Z

I've added qhelp in 020af1c. Here's a fresh LGTM run: https://lgtm.com/query/3939119318730344544/. Removing the post-dominance gave quite a lot of new results that I'm still going through.

I've been going through the results on LGTM, and it looks like removing post-dominance didn't introduce new false positives, but just added more flow (since the majority of the sinks didn't happen in a post-dominating position). It looks like it's raising a bunch of alerts on examples that follow this pattern:

struct A {
  virtual void f() = 0;
};

struct B : public A {
  void f() override {}
};

void call_f(A* a) { a->f(); }

struct C : public B {
  C() { call_f(this); }
}

(which is in the same spirit as the one marked as FALSE POSITIVE in the new tests).

We can fix this false positive (and all the ones on LGTM) by requiring that there is no override of the pure virtual function being called in any of the base classes of C. I've tested this here: https://lgtm.com/query/1100185598071201617/. This weeds out most results, with the exception of two which looks genuine:

One problem in a constructor in wxWidgets/wxWidgets
One problem in a destructor in scummvm/scummvm

So I guess it comes down to a choice between

Raise more alerts even though they won't trigger undefined behavior, but might not be what the programmer intended.
Raise fewer alerts, but only do so when it will definitely trigger undefined behavior.

I think I'm leaning toward the last option. I expect more results will pop up as we add more cases of 'must' flow. How does that sound?

jbj · 2020-11-19T10:59:51Z

I'm on board with the last option too: fewer but better alerts. The two results on LGTM LGTM (argh), and I especially like how clear it is in scummvm on line 51 that they forgot to write _orgStream->. Based on those results, I'd support setting @precision very-high.

@precision

…sts in any base class. This removes the false positive in the testcase. Based on the results on LGTM we have agreed to set the @precision to very-high.

MathiasVP · 2020-11-19T12:05:47Z

~~I've started a CPP-difference: https://jenkins.internal.semmle.com/job/Changes/job/CPP-Differences/1558/~~

jbj · 2020-11-20T13:50:05Z

Please merge from main and start a new CPP-Differences so that #4696 is included in both the before-SHA and the after-SHA.

MathiasVP · 2020-11-20T13:59:56Z

Please merge from main and start a new CPP-Differences so that #4696 is included in both the before-SHA and the after-SHA.

Done. I've started a fresh CPP-differences with #4696 included: https://jenkins.internal.semmle.com/job/Changes/job/CPP-Differences/1562/

MathiasVP · 2020-11-21T13:53:17Z

Done. I've started a fresh CPP-differences with #4696 included: https://jenkins.internal.semmle.com/job/Changes/job/CPP-Differences/1562/

What a sad CPP-difference 👎 It seems to all be from the new query. I will investigate!

Edit: It looks like the new query is causing IR re-evaluation.

geoffw0 · 2020-11-24T16:14:48Z

 import cpp
+// We don't actually use the global value numbering library in this query, but without it we end up
+// recomputing the IR.
+private import semmle.code.cpp.valuenumbering.GlobalValueNumbering


If this is true shouldn't semmle.code.cpp.valuenumbering.GlobalValueNumbering be imported in semmle.code.cpp.ir.IR, so that all users benefit?

It was indeed true:

As far as I know, this cache re-evaluation problem happens only in unlucky cases. We can maybe this at the team meeting on Thursday? In any case, I don't think we should do that change in this PR.

MathiasVP · 2020-11-25T06:49:52Z

648acc3 fixed the IR re-evaluation: https://jenkins.internal.semmle.com/job/Changes/job/CPP-Differences/1567/. Performance looks fine now.

jbj

🎉

MathiasVP added the C++ label Nov 10, 2020

MathiasVP requested a review from a team as a code owner November 10, 2020 14:06

github-actions Bot added the documentation label Nov 10, 2020

MathiasVP added 2 commits November 10, 2020 17:23

C++: Add new query for unsafe use of this.

4bcf1f4

C++: Update change-notes.

a330cae

MathiasVP force-pushed the unsafe-use-of-this-query branch from 321c3ec to a330cae Compare November 10, 2020 16:25

jbj self-assigned this Nov 11, 2020

jbj reviewed Nov 11, 2020

View reviewed changes

Comment thread change-notes/1.26/analysis-cpp.md Outdated

geoffw0 reviewed Nov 11, 2020

View reviewed changes

Comment thread cpp/ql/src/Likely Bugs/OO/UnsafeUseOfThis.cpp Outdated

Comment thread cpp/ql/src/Likely Bugs/OO/UnsafeUseOfThis.ql Outdated

MathiasVP and others added 3 commits November 11, 2020 18:12

Update cpp/ql/src/Likely Bugs/OO/UnsafeUseOfThis.cpp

de0ca0a

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>

C++: Respond to review comments.

e1ef41b

Merge branch 'unsafe-use-of-this-query' of github.com:MathiasVP/ql in…

44e38ab

…to unsafe-use-of-this-query

MathiasVP requested a review from a team as a code owner November 11, 2020 17:30

github-actions Bot added the C# label Nov 11, 2020

MathiasVP force-pushed the unsafe-use-of-this-query branch from b3400c4 to 50ddae4 Compare November 12, 2020 09:13

MathiasVP added 2 commits November 12, 2020 10:27

C++: Respond to more review comments.

4c27c37

C++: Follow the new change-note protocol.

50e9051

MathiasVP force-pushed the unsafe-use-of-this-query branch from 50ddae4 to 50e9051 Compare November 12, 2020 09:27

jbj reviewed Nov 12, 2020

View reviewed changes

Comment thread cpp/change-notes/2020-11-12-unsafe-use-of-this.md Outdated

MathiasVP and others added 5 commits November 12, 2020 11:28

Update cpp/change-notes/2020-11-12-unsafe-use-of-this.md

00f067b

Co-authored-by: Jonas Jensen <jbj@github.com>

C++/C#: Make post-dominator related predicates member predicates of I…

f2317ae

…RBlock.

C++: Fix dataflow pruning by evaluating successor before flowsToSink/…

896dee5

…flowsFromSource.

Merge branch 'unsafe-use-of-this-query' of github.com:MathiasVP/ql in…

5e1f36e

…to unsafe-use-of-this-query

jbj reviewed Nov 13, 2020

View reviewed changes

MathiasVP added 2 commits November 13, 2020 10:44

C++: Respond to review comments.

b249777

C++: Respond to more review comments.

0a6a225

- Remove post-dominance requirement. It was really just hiding good results. - Fix test annotations. Turns out Clang and GCC's 'undefined behavior' warning didn't align with the C++ standard.

C++: Add qhelp.

020af1c

MathiasVP requested a review from hubwriter as a code owner November 16, 2020 10:21

jbj reviewed Nov 16, 2020

View reviewed changes

hubwriter reviewed Nov 16, 2020

View reviewed changes

Comment thread cpp/change-notes/2020-11-12-unsafe-use-of-this.md Outdated

Comment thread cpp/ql/src/Likely Bugs/OO/UnsafeUseOfThis.qhelp Outdated

Comment thread cpp/ql/src/Likely Bugs/OO/UnsafeUseOfThis.qhelp Outdated

Comment thread cpp/ql/src/Likely Bugs/OO/UnsafeUseOfThis.ql Outdated

Update cpp/change-notes/2020-11-12-unsafe-use-of-this.md

10a9f7b

Co-authored-by: hubwriter <hubwriter@github.com>

MathiasVP mentioned this pull request Nov 16, 2020

C++: IR post dominance #4673

Merged

C++: Respond to review comments.

4a7f910

C++: Require that no override of the called pure virtual function exi…

072adaa

…sts in any base class. This removes the false positive in the testcase. Based on the results on LGTM we have agreed to set the @precision to very-high.

MathiasVP force-pushed the unsafe-use-of-this-query branch from f2e61ea to 072adaa Compare November 19, 2020 11:11

Merge branch 'main' into unsafe-use-of-this-query

2e6a3cd

Merge branch 'main' into unsafe-use-of-this-query

fd4f8c5

C++: Prevent IR re-evaluation by importing GVN.

648acc3

geoffw0 reviewed Nov 24, 2020

View reviewed changes

jbj approved these changes Nov 25, 2020

View reviewed changes

jbj merged commit 5f01419 into github:main Nov 25, 2020

MathiasVP mentioned this pull request Jan 21, 2022

C++: Use the IR for cpp/return-stack-allocated-memory. #7682

Merged

Conversation

MathiasVP commented Nov 10, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

geoffw0 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jbj commented Nov 13, 2020

Uh oh!

MathiasVP commented Nov 16, 2020

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MathiasVP commented Nov 19, 2020

Uh oh!

jbj commented Nov 19, 2020

Uh oh!

MathiasVP commented Nov 19, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jbj commented Nov 20, 2020

Uh oh!

MathiasVP commented Nov 20, 2020

Uh oh!

MathiasVP commented Nov 21, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

geoffw0 Nov 24, 2020

Choose a reason for hiding this comment

Uh oh!

MathiasVP Nov 25, 2020

Choose a reason for hiding this comment

Uh oh!

MathiasVP commented Nov 25, 2020

Uh oh!

jbj left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MathiasVP commented Nov 10, 2020 •

edited

Loading

MathiasVP commented Nov 19, 2020 •

edited

Loading

MathiasVP commented Nov 21, 2020 •

edited

Loading