@@ -205,17 +205,53 @@ private predicate deconstructSizeExpr(Expr sizeExpr, Expr lengthExpr, int sizeof
205205 sizeof = 1
206206}
207207
208+ /** A `Function` that is a call target of an allocation. */
208209private signature class CallAllocationExprTarget extends Function ;
209210
211+ /**
212+ * This module abstracts over the type of allocation call-targets and provides a
213+ * class `CallAllocationExprImpl` which contains the implementation of the various
214+ * predicates required by the `Allocation` class.
215+ *
216+ * This module is then instantiated for two types of allocation call-targets:
217+ * - `AllocationFunction`: Functions that we've explicitly modeled as functions that
218+ * perform allocations (i.e., `malloc`).
219+ * - `HeuristicAllocationFunction`: Functions that we deduce as behaving like an allocation
220+ * function using various heuristics.
221+ */
210222private module CallAllocationExprBase< CallAllocationExprTarget Target> {
223+ /**
224+ * A signature for a predicate that gets the index of the input pointer argument to
225+ * be reallocated, if this is a `realloc` function.
226+ */
211227 signature int getReallocPtrArgSig ( Target target ) ;
212228
229+ /**
230+ * A signature for a predicate that gets the index of the argument for the allocation
231+ * size, if any. The actual allocation size is the value of this argument multiplied
232+ * by the result of `getSizeMult()`, in bytes.
233+ */
213234 signature int getSizeArgSig ( Target target ) ;
214235
236+ /**
237+ * A signature for a predicate that gets the index of an argument that multiplies the
238+ * allocation size given by `getSizeArg`, if any.
239+ */
215240 signature int getSizeMultSig ( Target target ) ;
216241
242+ /**
243+ * A signature for a predicate that determines whether or not this allocation requires a
244+ * corresponding deallocation of some sort (most do, but `alloca` for example does not).
245+ * If it is unclear, we default to no (for example a placement `new` allocation may or
246+ * may not require a corresponding `delete`).
247+ */
217248 signature predicate requiresDeallocSig ( Target target ) ;
218249
250+ /**
251+ * A module that abstracts over the various predicates in a that should really be
252+ * member-predicates of `CallAllocationExprTarget` (which which we cannot yet write in
253+ * QL).
254+ */
219255 module With<
220256 getReallocPtrArgSig / 1 getReallocPtrArg, getSizeArgSig / 1 getSizeArg, getSizeMultSig / 1 getSizeMult,
221257 requiresDeallocSig / 1 requiresDealloc> {
@@ -285,6 +321,10 @@ private module CallAllocationExpr {
285321
286322 private predicate requiresDealloc ( AllocationFunction f ) { f .requiresDealloc ( ) }
287323
324+ /**
325+ * A class that provides the implementation of `AllocationExpr` for an allocation
326+ * that calls an `AllocationFunction`.
327+ */
288328 private class Base =
289329 CallAllocationExprBase< AllocationFunction > :: With< getReallocPtrArg / 1 , getSizeArg / 1 , getSizeMult / 1 , requiresDealloc / 1 > :: CallAllocationExprImpl ;
290330
@@ -343,6 +383,7 @@ private class NewArrayAllocationExpr extends AllocationExpr, NewArrayExpr {
343383}
344384
345385private module HeuristicAllocation {
386+ /** A class that maps an `AllocationExpr` to an `HeuristicAllocationExpr`. */
346387 private class HeuristicAllocationModeled extends HeuristicAllocationExpr instanceof AllocationExpr {
347388 override Expr getSizeExpr ( ) { result = AllocationExpr .super .getSizeExpr ( ) }
348389
@@ -359,6 +400,7 @@ private module HeuristicAllocation {
359400 override predicate requiresDealloc ( ) { AllocationExpr .super .requiresDealloc ( ) }
360401 }
361402
403+ /** A class that maps an `AllocationFunction` to an `HeuristicAllocationFunction`. */
362404 private class HeuristicAllocationFunctionModeled extends HeuristicAllocationFunction instanceof AllocationFunction {
363405 override int getSizeArg ( ) { result = AllocationFunction .super .getSizeArg ( ) }
364406
@@ -377,6 +419,12 @@ private module HeuristicAllocation {
377419 f .getParameter ( result ) .getUnspecifiedType ( ) instanceof PointerType
378420 }
379421
422+ /**
423+ * A class that uses heuristics to find additional allocation functions. The required are as follows:
424+ * 1. The word `alloc` must appear in the function name
425+ * 2. The function must return a pointer type
426+ * 3. There must be a unique parameter of unsigned integral type.
427+ */
380428 private class HeuristicAllocationFunctionByName extends HeuristicAllocationFunction instanceof Function {
381429 int sizeArg ;
382430
@@ -404,6 +452,10 @@ private module HeuristicAllocation {
404452
405453 private predicate requiresDealloc ( HeuristicAllocationFunction f ) { f .requiresDealloc ( ) }
406454
455+ /**
456+ * A class that provides the implementation of `AllocationExpr` for an allocation
457+ * that calls an `HeuristicAllocationFunction`.
458+ */
407459 private class Base =
408460 CallAllocationExprBase< HeuristicAllocationFunction > :: With< getReallocPtrArg / 1 , getSizeArg / 1 , getSizeMult / 1 , requiresDealloc / 1 > :: CallAllocationExprImpl ;
409461
0 commit comments