Open iiins0mn1a opened 5 months ago
Thank you for reaching out with this performance issue. Can you please share the entire log file with us (the one you already posted a snippet of)?
In general, here are some guidelines for optimising CodeQL queries that the team has written up in the CodeQL documentation:
Hi @ginsbach , thanks for your replying, and I've invited you in my private repo to check the entire log file. And thanks for your reference. Hope to your reply. Thank you.
Hi @ginsbach , thanks for your replying, and I've invited you in my private repo to check the entire log file. And thanks for your reference.
Besides, I've updated my toolchain to codeql-cli-v2.16.6 (ql-lib on tag v2.16.6 too). While same query works fine with VS Code extension, it reports a lot of ERRORs when I use CLI directly. These ERRORs seem to be internel errors, related log:
[2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to FlowState, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:408,46-55) [2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to FlowState, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:414,47-56) [2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to FlowState, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:426,19-28) [2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to FlowState, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:426,49-58) [2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to isAdditionalFlowStep, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:442,7-27) [2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to isAdditionalFlowStep, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:443,7-27) [2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to isAdditionalFlowStep, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:444,7-27) [2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to isAdditionalFlowStep, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:445,7-27) [2024-03-29 02:10:20] [ERROR] execute queries> ERROR: Predicate signature default may not refer to DataFlowCall, which is another member of the module signature. (/home/insomnia/codeql-new/query/Next-Starter/ql/shared/dataflow/codeql/dataflow/DataFlow.qll:80,47-59)
The ERROR related entire log has also been uploaded into the repo I've invited you in. Hope to your reply. Thank you
I will launch another issue for this question
Could you tell us more about the pattern you are trying to detect with this query? Rather than writing the logic yourself for matching function return values to function call expressions, the CodeQL dataflow library for C/C++ may be able to handle this for you already. I don't know your definition of isFromParaPointer/getParaPointerIndex
, but that sounds like it would be your definition of a tainted source, and you are looking for flow from such a source to a function call expression, or some other downstream sink.
Hi @adityasharad , thanks for your reply and sorry for my delay.
As you can see in my posted query, it's a part of recursive backtracing isTarget()
, and in this specific part, we are dealing with FunctionCall fc
to check the source of its return value.
And in some cases, return value Expr retexpr
may be from Parameter
s of this Function func
. As you pointed out, we use a local taint procedure provided in library to check whether the ReturnStmt ret
is from a parameter. If so, we perform further recursive procedure on the argument Expr argexpr
of the FunctionCall fc
, otherwise we perform recursive procedure on the retexpr
.
Feel free to contact my if anything is unclaer. Thanks again.
related log:
My query has been running far far more than 669s, but no further output log, it's confusing for me to debug.
Related query:
These LoCs are for checking whether a
FunctionCall
's returnedExpr
is from (local taint) its arguments, and determine what's next on recursive back-tracingisTarget()
.I'm using a out-dated version of CodeQL CLI, maybe I'll update my tool chains first. But still hope to be helped~