Skip to content

Commit e986cca

Browse files
hvitvedhvitved
authored
Merge pull request #20843 from hvitved/rust/access-after-lifetime-speedup
Rust: Speedup `AccessAfterLifetime.ql`
2 parents fabcd04 + 8455663 commit e986cca

File tree

2 files changed

+17
-69
lines changed

2 files changed

+17
-69
lines changed

‎rust/ql/src/queries/security/CWE-825/AccessAfterLifetime.ql‎

Lines changed: 17 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,22 @@ import AccessAfterLifetimeFlow::PathGraph
2323
* lifetime has ended.
2424
*/
2525
module AccessAfterLifetimeConfig implements DataFlow::ConfigSig {
26-
predicate isSource(DataFlow::Node node) { node instanceof AccessAfterLifetime::Source }
26+
predicate isSource(DataFlow::Node node) {
27+
node instanceof AccessAfterLifetime::Source and
28+
// exclude cases with sources in macros, since these results are difficult to interpret
29+
not node.asExpr().getExpr().isFromMacroExpansion()
30+
}
2731

28-
predicate isSink(DataFlow::Node node) { node instanceof AccessAfterLifetime::Sink }
32+
predicate isSink(DataFlow::Node node) {
33+
node instanceof AccessAfterLifetime::Sink and
34+
// exclude cases with sinks in macros, since these results are difficult to interpret
35+
not node.asExpr().getExpr().isFromMacroExpansion() and
36+
// include only results inside `unsafe` blocks, as other results tend to be false positives
37+
(
38+
node.asExpr().getExpr().getEnclosingBlock*().isUnsafe() or
39+
node.asExpr().getExpr().getEnclosingCallable().(Function).isUnsafe()
40+
)
41+
}
2942

3043
predicate isBarrier(DataFlow::Node barrier) { barrier instanceof AccessAfterLifetime::Barrier }
3144

@@ -36,34 +49,20 @@ module AccessAfterLifetimeConfig implements DataFlow::ConfigSig {
3649
result = [target.getLocation(), source.getLocation()]
3750
|
3851
isSink(sink) and
39-
narrowDereferenceAfterLifetime(source, sink, target)
52+
AccessAfterLifetime::dereferenceAfterLifetime(source, sink, target)
4053
)
4154
}
4255
}
4356

4457
module AccessAfterLifetimeFlow = TaintTracking::Global<AccessAfterLifetimeConfig>;
4558

46-
pragma[inline]
47-
predicate narrowDereferenceAfterLifetime(DataFlow::Node source, DataFlow::Node sink, Variable target) {
48-
// check that the dereference is outside the lifetime of the target
49-
AccessAfterLifetime::dereferenceAfterLifetime(source, sink, target) and
50-
// include only results inside `unsafe` blocks, as other results tend to be false positives
51-
(
52-
sink.asExpr().getExpr().getEnclosingBlock*().isUnsafe() or
53-
sink.asExpr().getExpr().getEnclosingCallable().(Function).isUnsafe()
54-
) and
55-
// exclude cases with sources / sinks in macros, since these results are difficult to interpret
56-
not source.asExpr().getExpr().isFromMacroExpansion() and
57-
not sink.asExpr().getExpr().isFromMacroExpansion()
58-
}
59-
6059
from
6160
AccessAfterLifetimeFlow::PathNode sourceNode, AccessAfterLifetimeFlow::PathNode sinkNode,
6261
Variable target
6362
where
6463
// flow from a pointer or reference to the dereference
6564
AccessAfterLifetimeFlow::flowPath(sourceNode, sinkNode) and
6665
// check that the dereference is outside the lifetime of the target
67-
narrowDereferenceAfterLifetime(sourceNode.getNode(), sinkNode.getNode(), target)
66+
AccessAfterLifetime::dereferenceAfterLifetime(sourceNode.getNode(), sinkNode.getNode(), target)
6867
select sinkNode.getNode(), sourceNode, sinkNode,
6968
"Access of a pointer to $@ after its lifetime has ended.", target, target.toString()

‎rust/ql/test/query-tests/security/CWE-825/AccessAfterLifetime.expected‎

Lines changed: 0 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -186,28 +186,6 @@ edges
186186
| lifetime.rs:655:11:655:25 | &raw const str2 | lifetime.rs:655:4:655:7 | ref1 | provenance | |
187187
| lifetime.rs:655:11:655:25 | &raw const str2 [&ref] | lifetime.rs:655:4:655:7 | ref1 [&ref] | provenance | |
188188
| lifetime.rs:655:22:655:25 | str2 | lifetime.rs:655:11:655:25 | &raw const str2 [&ref] | provenance | |
189-
| lifetime.rs:680:7:680:8 | r1 | lifetime.rs:692:13:692:14 | r1 | provenance | |
190-
| lifetime.rs:682:4:682:12 | &... | lifetime.rs:680:7:680:8 | r1 | provenance | |
191-
| lifetime.rs:684:7:684:14 | TuplePat [tuple.0] | lifetime.rs:684:8:684:9 | r2 | provenance | |
192-
| lifetime.rs:684:7:684:14 | TuplePat [tuple.1] | lifetime.rs:684:12:684:13 | r3 | provenance | |
193-
| lifetime.rs:684:8:684:9 | r2 | lifetime.rs:693:13:693:14 | r2 | provenance | |
194-
| lifetime.rs:684:12:684:13 | r3 | lifetime.rs:694:13:694:14 | r3 | provenance | |
195-
| lifetime.rs:686:4:687:16 | TupleExpr [tuple.0] | lifetime.rs:684:7:684:14 | TuplePat [tuple.0] | provenance | |
196-
| lifetime.rs:686:4:687:16 | TupleExpr [tuple.1] | lifetime.rs:684:7:684:14 | TuplePat [tuple.1] | provenance | |
197-
| lifetime.rs:686:5:686:13 | &... | lifetime.rs:686:4:687:16 | TupleExpr [tuple.0] | provenance | |
198-
| lifetime.rs:687:5:687:15 | &... | lifetime.rs:686:4:687:16 | TupleExpr [tuple.1] | provenance | |
199-
| lifetime.rs:717:35:723:2 | { ... } | lifetime.rs:730:11:730:25 | e1.test_match() | provenance | |
200-
| lifetime.rs:718:7:718:8 | r1 | lifetime.rs:717:35:723:2 | { ... } | provenance | |
201-
| lifetime.rs:719:26:719:34 | &... | lifetime.rs:718:7:718:8 | r1 | provenance | |
202-
| lifetime.rs:730:6:730:7 | r1 | lifetime.rs:734:12:734:13 | r1 | provenance | |
203-
| lifetime.rs:730:11:730:25 | e1.test_match() | lifetime.rs:730:6:730:7 | r1 | provenance | |
204-
| lifetime.rs:766:2:766:11 | &val | lifetime.rs:766:2:766:11 | ptr | provenance | |
205-
| lifetime.rs:766:2:766:11 | ptr | lifetime.rs:766:2:766:11 | ptr | provenance | |
206-
| lifetime.rs:767:2:767:11 | &val | lifetime.rs:767:2:767:11 | ptr | provenance | |
207-
| lifetime.rs:767:2:767:11 | ptr | lifetime.rs:767:2:767:11 | ptr | provenance | |
208-
| lifetime.rs:769:6:769:8 | ptr | lifetime.rs:771:12:771:14 | ptr | provenance | |
209-
| lifetime.rs:769:12:769:21 | &val | lifetime.rs:769:12:769:21 | ptr | provenance | |
210-
| lifetime.rs:769:12:769:21 | ptr | lifetime.rs:769:6:769:8 | ptr | provenance | |
211189
| lifetime.rs:781:2:781:19 | return ... | lifetime.rs:785:11:785:41 | get_local_for_unsafe_function(...) | provenance | |
212190
| lifetime.rs:781:9:781:19 | &my_local10 | lifetime.rs:781:2:781:19 | return ... | provenance | |
213191
| lifetime.rs:785:6:785:7 | p1 | lifetime.rs:789:12:789:13 | p1 | provenance | |
@@ -421,35 +399,6 @@ nodes
421399
| lifetime.rs:655:22:655:25 | str2 | semmle.label | str2 |
422400
| lifetime.rs:659:15:659:18 | ref1 | semmle.label | ref1 |
423401
| lifetime.rs:667:14:667:17 | ref1 | semmle.label | ref1 |
424-
| lifetime.rs:680:7:680:8 | r1 | semmle.label | r1 |
425-
| lifetime.rs:682:4:682:12 | &... | semmle.label | &... |
426-
| lifetime.rs:684:7:684:14 | TuplePat [tuple.0] | semmle.label | TuplePat [tuple.0] |
427-
| lifetime.rs:684:7:684:14 | TuplePat [tuple.1] | semmle.label | TuplePat [tuple.1] |
428-
| lifetime.rs:684:8:684:9 | r2 | semmle.label | r2 |
429-
| lifetime.rs:684:12:684:13 | r3 | semmle.label | r3 |
430-
| lifetime.rs:686:4:687:16 | TupleExpr [tuple.0] | semmle.label | TupleExpr [tuple.0] |
431-
| lifetime.rs:686:4:687:16 | TupleExpr [tuple.1] | semmle.label | TupleExpr [tuple.1] |
432-
| lifetime.rs:686:5:686:13 | &... | semmle.label | &... |
433-
| lifetime.rs:687:5:687:15 | &... | semmle.label | &... |
434-
| lifetime.rs:692:13:692:14 | r1 | semmle.label | r1 |
435-
| lifetime.rs:693:13:693:14 | r2 | semmle.label | r2 |
436-
| lifetime.rs:694:13:694:14 | r3 | semmle.label | r3 |
437-
| lifetime.rs:717:35:723:2 | { ... } | semmle.label | { ... } |
438-
| lifetime.rs:718:7:718:8 | r1 | semmle.label | r1 |
439-
| lifetime.rs:719:26:719:34 | &... | semmle.label | &... |
440-
| lifetime.rs:730:6:730:7 | r1 | semmle.label | r1 |
441-
| lifetime.rs:730:11:730:25 | e1.test_match() | semmle.label | e1.test_match() |
442-
| lifetime.rs:734:12:734:13 | r1 | semmle.label | r1 |
443-
| lifetime.rs:766:2:766:11 | &val | semmle.label | &val |
444-
| lifetime.rs:766:2:766:11 | ptr | semmle.label | ptr |
445-
| lifetime.rs:766:2:766:11 | ptr | semmle.label | ptr |
446-
| lifetime.rs:767:2:767:11 | &val | semmle.label | &val |
447-
| lifetime.rs:767:2:767:11 | ptr | semmle.label | ptr |
448-
| lifetime.rs:767:2:767:11 | ptr | semmle.label | ptr |
449-
| lifetime.rs:769:6:769:8 | ptr | semmle.label | ptr |
450-
| lifetime.rs:769:12:769:21 | &val | semmle.label | &val |
451-
| lifetime.rs:769:12:769:21 | ptr | semmle.label | ptr |
452-
| lifetime.rs:771:12:771:14 | ptr | semmle.label | ptr |
453402
| lifetime.rs:781:2:781:19 | return ... | semmle.label | return ... |
454403
| lifetime.rs:781:9:781:19 | &my_local10 | semmle.label | &my_local10 |
455404
| lifetime.rs:785:6:785:7 | p1 | semmle.label | p1 |

0 commit comments

Comments
 (0)