Generating a Complete Control Flow Graph

[sei-yhindka]

Dear CodeQL Team,

Hope you are well. We are having a great time experimenting with your tool, but we had a question regarding control flow graphs.
We are trying to generate a complete control flow graph which starts at a function of our choosing in the OpenCV codebase. Here is the query we are using:

/**
 * @name Control Flow Example
 * @kind graph
 * @id cpp/control-flow-example
 */

 import cpp
 import semmle.code.cpp.pointsto.CallGraph
 
 from Function caller, Function callee, Function root, Location callerLocation, Location calleeLocation
 
 where 
     root.hasName("imageBarCodeDetect")
     and (allCalls(caller, callee)
     )
     and allCalls*(root, caller)
     and callerLocation = caller.getLocation()
     and calleeLocation = callee.getLocation()
 
 select caller.toString() + "," + callerLocation.getFile().getBaseName() + "," + callerLocation.getStartLine(),
        callee.toString() + "," + calleeLocation.getFile().getBaseName() + "," + calleeLocation.getStartLine()

At https://github.com/opencv/opencv/blob/4.x/samples/cpp/barcode.cpp#L144, there is a function call to imread(), which then calls imread_(). You can see PNG and DOT files of the generated control flow graph here:

control_flow_graph.txt
control_flow_graph.png

In the PNG, you will see that the imread() declaration at https://github.com/opencv/opencv/blob/4.x/modules/imgcodecs/include/opencv2/imgcodecs.hpp#L271 is visible, but the control flow stops after that; there is no flow to the imread_() function. Is there something wrong with our query? Or do you think there is something wrong with the database? We would love your thoughts. Thanks!

[aibaars]

I see the flow ends at imgcodecs.hpp:271 but you expected it to go to loadsave.cpp:630 and continue from there.

That is a very good question. It might be worth checking whether theFunctionDeclarationEntrys for the definitions of imread() in the imgcodecs.hpp and the loadsave.cpp files both refer to the same Function entity in the database. If not, that might explain why QL isn't reporting further flow. I think this may happen if the function call in barcode.cpp and the definition in loadsave.cpp are compiled into two different link targets.

[sei-yhindka]

Thanks for the insight. It appears that is the case: CMakeLists.txt:7; imgcodecs is linked as a dependency for the barcode.cpp example. It's possible that if imgcodecs was already compiled, then CodeQL would not be able to generate a database entry for it when compiling the barcode.cpp sample. Is this a limitation of CodeQL then, or is there a way around this? Maybe we could completely clean the OpenCV build and then only build the barcode.cpp sample? I do recall completely cleaning before building, but perhaps we could try again.