Skip to content

C++: Multi-Level Member Function Calls Not Modeled as DataFlow::Node #19457

Closed as not planned
@mcc0612mcc0612

Description

@mcc0612mcc0612

Description of the issue

In my CodeQL analysis, I encountered an issue where multi-level function pointer calls are not modeled as DataFlow::Node.

Here is a minimal example to reproduce the issue:

class A {
    public:
        void doSomething() {}
};

class B {
    public:
        A getA() {
            return a;
        }
    private:
        A a;
};

int main() {
    B b;
    b.getA().doSomething();
    return 0;
}

Specifically, while I can find getA() modeled as a DataFlow::Node with findNodeforGetA, I fail to find the corresponding node for doSomething() when searching with findNodeforDoSomething.

Here is my query to find corresponding nodes:

Expr findNodeforGetA() {
    exists(Call c, DataFlow::Node node
      | node.asExpr() = c and
        resolveCall(c.(Call)).getName() = "getA"
      | result = node.asExpr()
    )
}

Expr findNodeforDoSomething() {
    exists(Call c, DataFlow::Node node
      | node.asExpr() = c and
        resolveCall(c.(Call)).getName() = "doSomething"
      | result = node.asExpr()
    )
}

So, is this desgned intentionally or due to some other reasons?

More Context:
By the way, my goal is to check the domination relationship between functions. For example, given the following code.

b.getA().doSomething();
doSomethingElse();

I want to check if A::doSomething dominates doSomethingElse using the following query:

predicate defaultDominate(DataFlow::Node dom, DataFlow::Node sub) {
  exists(IRBlock b1, int i1, IRBlock b2, int i2 |
    dom.hasIndexInBlock(b1, i1) and
    sub.hasIndexInBlock(b2, i2) and
    (
      b1 = b2 and
      i1 < i2
      or
      b1.dominates(b2)
    )
  )
}

The failure to find the corresponding DataFlow::Node for doSomething() prevents me from using the defaultDominate predicate to analyze the domination relationship.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Staleawaiting-responseThe CodeQL team is awaiting further input or clarification from the original reporter of this issue.questionFurther information is requested

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions