|
| 1 | +/** |
| 2 | + * @id c/cert/do-not-access-volatile-object-with-non-volatile-reference |
| 3 | + * @name EXP32-C: Do not access a volatile object through a nonvolatile reference |
| 4 | + * @description If an an object defined with a volatile-qualified type is referred to with an lvalue |
| 5 | + * of a non-volatile-qualified type, the behavior is undefined. |
| 6 | + * @kind problem |
| 7 | + * @precision high |
| 8 | + * @problem.severity error |
| 9 | + * @tags external/cert/id/exp32-c |
| 10 | + * correctness |
| 11 | + * external/cert/obligation/rule |
| 12 | + */ |
| 13 | + |
| 14 | +import cpp |
| 15 | +import codingstandards.c.cert |
| 16 | +import semmle.code.cpp.controlflow.Dereferenced |
| 17 | + |
| 18 | +/** |
| 19 | + * An expression involving volatile-qualified types that results in undefined behavior. |
| 20 | + */ |
| 21 | +abstract class UndefinedVolatilePointerExpr extends Expr { |
| 22 | + /** |
| 23 | + * Gets a descriptive string describing the type of expression and undefined behavior. |
| 24 | + */ |
| 25 | + abstract string getMessage(); |
| 26 | +} |
| 27 | + |
| 28 | +/** |
| 29 | + * Gets the depth of a pointer's base type's volatile qualifier |
| 30 | + */ |
| 31 | +int getAVolatileDepth(Type type) { |
| 32 | + type.isVolatile() and result = 1 |
| 33 | + or |
| 34 | + result = getAVolatileDepth(type.(DerivedType).getBaseType()) + 1 |
| 35 | +} |
| 36 | + |
| 37 | +/** |
| 38 | + * A `Cast` which converts from a pointer to a volatile-qualified type |
| 39 | + * to a pointer to a non-volatile-qualified type. |
| 40 | + */ |
| 41 | +class CastFromVolatileToNonVolatileBaseType extends Cast, UndefinedVolatilePointerExpr { |
| 42 | + CastFromVolatileToNonVolatileBaseType() { |
| 43 | + exists(int i | |
| 44 | + i = getAVolatileDepth(this.getExpr().getType()) and |
| 45 | + not i = getAVolatileDepth(this.getActualType()) |
| 46 | + ) |
| 47 | + } |
| 48 | + |
| 49 | + override string getMessage() { |
| 50 | + result = "Cast of object with a volatile-qualified type to a non-volatile-qualified type." |
| 51 | + } |
| 52 | +} |
| 53 | + |
| 54 | +/** |
| 55 | + * Holds if `va` has a subsequent `VariableAccess` which is dereferenced after access |
| 56 | + */ |
| 57 | +bindingset[va] |
| 58 | +predicate hasSubsequentDereference(VariableAccess va) { |
| 59 | + dereferenced(pragma[only_bind_out](va).getASuccessor+()) |
| 60 | +} |
| 61 | + |
| 62 | +/** |
| 63 | + * An `AssignExpr` with an *lvalue* that is a pointer to a volatile base type and |
| 64 | + * and *rvalue* that is not also a pointer to a volatile base type. |
| 65 | + */ |
| 66 | +class NonVolatileObjectAssignedToVolatilePointer extends AssignExpr, UndefinedVolatilePointerExpr { |
| 67 | + NonVolatileObjectAssignedToVolatilePointer() { |
| 68 | + exists(int i | |
| 69 | + not i = getAVolatileDepth(this.getRValue().getType()) and |
| 70 | + i = getAVolatileDepth(this.getLValue().(VariableAccess).getTarget().getType()) |
| 71 | + ) and |
| 72 | + // Checks for subsequent accesses to the underlying object via the original non-volatile |
| 73 | + // pointer assigned to the volatile pointer. This heuristic can cause false-positives |
| 74 | + // in certain instances which require more advanced reachability analysis, e.g. loops and scope |
| 75 | + // considerations that this simple forward traversal of the control-flow graph does not account for. |
| 76 | + exists(VariableAccess va | |
| 77 | + va = this.getRValue().getAChild*().(VariableAccess).getTarget().getAnAccess() and |
| 78 | + hasSubsequentDereference(va) |
| 79 | + ) |
| 80 | + } |
| 81 | + |
| 82 | + override string getMessage() { |
| 83 | + result = |
| 84 | + "Assignment indicates a volatile object, but a later access of the object occurs via a non-volatile pointer." |
| 85 | + } |
| 86 | +} |
| 87 | + |
| 88 | +from UndefinedVolatilePointerExpr e |
| 89 | +where not isExcluded(e, Pointers3Package::doNotAccessVolatileObjectWithNonVolatileReferenceQuery()) |
| 90 | +select e, e.getMessage() |
0 commit comments