Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 09a7573

Browse files
MathiasVPMathiasVP
committed
C++: Add comments to the new FP.
1 parent 0a6f914 commit 09a7573

2 files changed

Lines changed: 21 additions & 14 deletions

File tree

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8090,20 +8090,20 @@
80908090
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:523:8:523:9 | vs | |
80918091
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:524:8:524:9 | vs | |
80928092
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:526:8:526:9 | vs | |
8093-
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:532:8:532:9 | vs | |
8094-
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:533:2:533:2 | vs | |
8093+
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:539:8:539:9 | vs | |
8094+
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:540:2:540:2 | vs | |
80958095
| vector.cpp:520:30:520:30 | 0 | vector.cpp:520:25:520:31 | call to vector | TAINT |
80968096
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:524:8:524:9 | vs | |
80978097
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:526:8:526:9 | vs | |
8098-
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
8099-
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
8098+
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:539:8:539:9 | vs | |
8099+
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:540:2:540:2 | vs | |
81008100
| vector.cpp:523:8:523:9 | vs | vector.cpp:523:10:523:10 | call to operator[] | TAINT |
81018101
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:526:8:526:9 | vs | |
8102-
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
8103-
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
8102+
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:539:8:539:9 | vs | |
8103+
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:540:2:540:2 | vs | |
81048104
| vector.cpp:524:8:524:9 | vs | vector.cpp:524:10:524:10 | call to operator[] | TAINT |
8105-
| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
8106-
| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
8105+
| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:539:8:539:9 | vs | |
8106+
| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:540:2:540:2 | vs | |
81078107
| vector.cpp:526:8:526:9 | vs | vector.cpp:526:11:526:15 | call to begin | TAINT |
81088108
| vector.cpp:526:11:526:15 | call to begin | vector.cpp:526:3:526:17 | ... = ... | |
81098109
| vector.cpp:526:11:526:15 | call to begin | vector.cpp:527:9:527:10 | it | |
@@ -8128,5 +8128,5 @@
81288128
| vector.cpp:530:3:530:4 | ref arg it | vector.cpp:531:9:531:10 | it | |
81298129
| vector.cpp:530:9:530:14 | call to source | vector.cpp:530:3:530:4 | ref arg it | TAINT |
81308130
| vector.cpp:531:9:531:10 | it | vector.cpp:531:8:531:8 | call to operator* | TAINT |
8131-
| vector.cpp:532:8:532:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
8132-
| vector.cpp:532:8:532:9 | vs | vector.cpp:532:10:532:10 | call to operator[] | TAINT |
8131+
| vector.cpp:539:8:539:9 | ref arg vs | vector.cpp:540:2:540:2 | vs | |
8132+
| vector.cpp:539:8:539:9 | vs | vector.cpp:539:10:539:10 | call to operator[] | TAINT |

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -523,12 +523,19 @@ void test_vector_iterator() {
523523
sink(vs[1]);
524524
sink(vs[source()]); // $ MISSING: ast,ir
525525

526-
it = vs.begin();
526+
it = vs.begin(); // (1)
527527
sink(*it);
528528
it += 1;
529529
sink(*it);
530-
it += source();
531-
sink(*it); // $ ast,ir
532-
sink(vs[1]); // $ SPURIOUS: ir
530+
it += source(); // (2)
531+
sink(*it); // $ ast,ir // (3)
532+
// This FP happens because of the following flows:
533+
// 1. There's a write to the iterator at (2)
534+
// 2. This write propagates to `it` on the next line at (3)
535+
// 3. There's a taint step from `it` to `*it` at (3)
536+
// 4. The `*it` is seen as a use of `vs` because of (1).
537+
// 5. There's use-use flow from `*it` at (3) (which is a use of `vs`) to `vs` at (4)
538+
// 6. There's a taint step from vs to vs[1]
539+
sink(vs[1]); // $ SPURIOUS: ir // (4)
533540
}
534541
}

0 commit comments

Comments
 (0)