Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 94d4e05

Browse files
author
Robert Marsh
committed
C++: Fix iterator taint flow
1 parent 656340f commit 94d4e05

4 files changed

Lines changed: 42 additions & 5 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,7 @@ class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunc
218218
/**
219219
* An `operator++` or `operator--` member function for an iterator type.
220220
*/
221-
class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunction {
221+
class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunction, TaintFunction {
222222
IteratorCrementMemberOperator() {
223223
(
224224
this.hasName("operator++") or
@@ -231,6 +231,11 @@ class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunction {
231231
input.isQualifierAddress() and
232232
output.isReturnValue()
233233
}
234+
235+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
236+
input.isQualifierObject() and
237+
output.isReturnValueDeref()
238+
}
234239
}
235240

236241
/**
@@ -253,17 +258,16 @@ class IteratorFieldMemberOperator extends Operator, TaintFunction {
253258
*/
254259
class IteratorBinaryArithmeticMemberOperator extends MemberFunction, TaintFunction {
255260
IteratorBinaryArithmeticMemberOperator() {
256-
this.hasName("operator-") and
257-
this.getDeclaringType() instanceof Iterator and
258-
this.getParameter(0).getUnspecifiedType() instanceof Iterator
261+
(this.hasName("operator+") or this.hasName("operator-")) and
262+
this.getDeclaringType() instanceof Iterator
259263
}
260264

261265
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
262266
(
263267
input.isQualifierObject() or
264268
input.isParameter(0)
265269
) and
266-
output.isQualifierObject()
270+
output.isReturnValue()
267271
}
268272
}
269273

@@ -287,6 +291,9 @@ class IteratorAssignArithmeticMemberOperator extends MemberFunction, DataFlowFun
287291
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
288292
input.isParameter(0) and
289293
output.isQualifierObject()
294+
or
295+
input.isQualifierObject() and
296+
output.isReturnValueDeref()
290297
}
291298
}
292299

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -369,6 +369,7 @@
369369
| string.cpp:119:16:119:24 | call to basic_string | string.cpp:124:50:124:50 | s | |
370370
| string.cpp:119:16:119:24 | call to basic_string | string.cpp:128:16:128:16 | s | |
371371
| string.cpp:120:15:120:15 | (__begin) | string.cpp:120:15:120:15 | call to operator* | TAINT |
372+
| string.cpp:120:15:120:15 | (__begin) | string.cpp:120:15:120:15 | call to operator++ | TAINT |
372373
| string.cpp:120:15:120:15 | (__range) | string.cpp:120:15:120:15 | call to begin | TAINT |
373374
| string.cpp:120:15:120:15 | call to begin | string.cpp:120:15:120:15 | (__begin) | |
374375
| string.cpp:120:15:120:15 | call to begin | string.cpp:120:15:120:15 | (__begin) | |
@@ -390,11 +391,13 @@
390391
| string.cpp:124:35:124:39 | call to begin | string.cpp:125:9:125:10 | it | |
391392
| string.cpp:124:50:124:50 | ref arg s | string.cpp:124:50:124:50 | s | |
392393
| string.cpp:124:50:124:50 | ref arg s | string.cpp:128:16:128:16 | s | |
394+
| string.cpp:124:61:124:62 | it | string.cpp:124:59:124:59 | call to operator++ | TAINT |
393395
| string.cpp:124:61:124:62 | ref arg it | string.cpp:124:44:124:45 | it | |
394396
| string.cpp:124:61:124:62 | ref arg it | string.cpp:124:61:124:62 | it | |
395397
| string.cpp:124:61:124:62 | ref arg it | string.cpp:125:9:125:10 | it | |
396398
| string.cpp:125:9:125:10 | it | string.cpp:125:8:125:8 | call to operator* | TAINT |
397399
| string.cpp:128:16:128:16 | (__begin) | string.cpp:128:16:128:16 | call to operator* | TAINT |
400+
| string.cpp:128:16:128:16 | (__begin) | string.cpp:128:16:128:16 | call to operator++ | TAINT |
398401
| string.cpp:128:16:128:16 | (__range) | string.cpp:128:16:128:16 | call to begin | TAINT |
399402
| string.cpp:128:16:128:16 | call to begin | string.cpp:128:16:128:16 | (__begin) | |
400403
| string.cpp:128:16:128:16 | call to begin | string.cpp:128:16:128:16 | (__begin) | |
@@ -411,6 +414,7 @@
411414
| string.cpp:132:28:132:33 | call to source | string.cpp:132:28:132:36 | call to basic_string | TAINT |
412415
| string.cpp:132:28:132:36 | call to basic_string | string.cpp:133:22:133:28 | const_s | |
413416
| string.cpp:133:22:133:22 | (__begin) | string.cpp:133:22:133:22 | call to operator* | TAINT |
417+
| string.cpp:133:22:133:22 | (__begin) | string.cpp:133:22:133:22 | call to operator++ | TAINT |
414418
| string.cpp:133:22:133:22 | (__range) | string.cpp:133:22:133:22 | call to begin | TAINT |
415419
| string.cpp:133:22:133:22 | call to begin | string.cpp:133:22:133:22 | (__begin) | |
416420
| string.cpp:133:22:133:22 | call to begin | string.cpp:133:22:133:22 | (__begin) | |
@@ -739,6 +743,7 @@
739743
| string.cpp:364:28:364:32 | call to begin | string.cpp:376:8:376:9 | i2 | |
740744
| string.cpp:364:28:364:32 | call to begin | string.cpp:379:8:379:9 | i2 | |
741745
| string.cpp:364:28:364:32 | call to begin | string.cpp:381:8:381:9 | i2 | |
746+
| string.cpp:367:10:367:11 | i2 | string.cpp:367:12:367:12 | call to operator+ | TAINT |
742747
| string.cpp:367:10:367:11 | ref arg i2 | string.cpp:368:10:368:11 | i2 | |
743748
| string.cpp:367:10:367:11 | ref arg i2 | string.cpp:369:8:369:9 | i2 | |
744749
| string.cpp:367:10:367:11 | ref arg i2 | string.cpp:371:8:371:9 | i2 | |
@@ -747,36 +752,45 @@
747752
| string.cpp:367:10:367:11 | ref arg i2 | string.cpp:379:8:379:9 | i2 | |
748753
| string.cpp:367:10:367:11 | ref arg i2 | string.cpp:381:8:381:9 | i2 | |
749754
| string.cpp:367:12:367:12 | call to operator+ | string.cpp:367:8:367:8 | call to operator* | TAINT |
755+
| string.cpp:367:13:367:13 | 1 | string.cpp:367:12:367:12 | call to operator+ | TAINT |
756+
| string.cpp:368:10:368:11 | i2 | string.cpp:368:12:368:12 | call to operator- | TAINT |
750757
| string.cpp:368:10:368:11 | ref arg i2 | string.cpp:369:8:369:9 | i2 | |
751758
| string.cpp:368:10:368:11 | ref arg i2 | string.cpp:371:8:371:9 | i2 | |
752759
| string.cpp:368:10:368:11 | ref arg i2 | string.cpp:373:8:373:9 | i2 | |
753760
| string.cpp:368:10:368:11 | ref arg i2 | string.cpp:376:8:376:9 | i2 | |
754761
| string.cpp:368:10:368:11 | ref arg i2 | string.cpp:379:8:379:9 | i2 | |
755762
| string.cpp:368:10:368:11 | ref arg i2 | string.cpp:381:8:381:9 | i2 | |
756763
| string.cpp:368:12:368:12 | call to operator- | string.cpp:368:8:368:8 | call to operator* | TAINT |
764+
| string.cpp:368:13:368:13 | 1 | string.cpp:368:12:368:12 | call to operator- | TAINT |
757765
| string.cpp:369:8:369:9 | i2 | string.cpp:369:3:369:9 | ... = ... | |
758766
| string.cpp:369:8:369:9 | i2 | string.cpp:370:12:370:13 | i3 | |
759767
| string.cpp:370:10:370:10 | call to operator++ | string.cpp:370:8:370:8 | call to operator* | TAINT |
768+
| string.cpp:370:12:370:13 | i3 | string.cpp:370:10:370:10 | call to operator++ | TAINT |
760769
| string.cpp:371:8:371:9 | i2 | string.cpp:371:3:371:9 | ... = ... | |
761770
| string.cpp:371:8:371:9 | i2 | string.cpp:372:12:372:13 | i4 | |
762771
| string.cpp:372:10:372:10 | call to operator-- | string.cpp:372:8:372:8 | call to operator* | TAINT |
772+
| string.cpp:372:12:372:13 | i4 | string.cpp:372:10:372:10 | call to operator-- | TAINT |
763773
| string.cpp:373:8:373:9 | i2 | string.cpp:373:3:373:9 | ... = ... | |
764774
| string.cpp:373:8:373:9 | i2 | string.cpp:374:3:374:4 | i5 | |
765775
| string.cpp:373:8:373:9 | i2 | string.cpp:375:9:375:10 | i5 | |
776+
| string.cpp:374:3:374:4 | i5 | string.cpp:374:5:374:5 | call to operator++ | TAINT |
766777
| string.cpp:374:3:374:4 | ref arg i5 | string.cpp:375:9:375:10 | i5 | |
767778
| string.cpp:375:9:375:10 | i5 | string.cpp:375:8:375:8 | call to operator* | TAINT |
768779
| string.cpp:376:8:376:9 | i2 | string.cpp:376:3:376:9 | ... = ... | |
769780
| string.cpp:376:8:376:9 | i2 | string.cpp:377:3:377:4 | i6 | |
770781
| string.cpp:376:8:376:9 | i2 | string.cpp:378:9:378:10 | i6 | |
782+
| string.cpp:377:3:377:4 | i6 | string.cpp:377:5:377:5 | call to operator-- | TAINT |
771783
| string.cpp:377:3:377:4 | ref arg i6 | string.cpp:378:9:378:10 | i6 | |
772784
| string.cpp:378:9:378:10 | i6 | string.cpp:378:8:378:8 | call to operator* | TAINT |
773785
| string.cpp:379:8:379:9 | i2 | string.cpp:379:3:379:9 | ... = ... | |
774786
| string.cpp:379:8:379:9 | i2 | string.cpp:380:10:380:11 | i7 | |
787+
| string.cpp:380:10:380:11 | i7 | string.cpp:380:12:380:12 | call to operator+= | TAINT |
775788
| string.cpp:380:12:380:12 | call to operator+= | string.cpp:380:8:380:8 | call to operator* | TAINT |
776789
| string.cpp:380:14:380:14 | 1 | string.cpp:380:10:380:11 | ref arg i7 | TAINT |
777790
| string.cpp:380:14:380:14 | 1 | string.cpp:380:12:380:12 | call to operator+= | |
778791
| string.cpp:381:8:381:9 | i2 | string.cpp:381:3:381:9 | ... = ... | |
779792
| string.cpp:381:8:381:9 | i2 | string.cpp:382:10:382:11 | i8 | |
793+
| string.cpp:382:10:382:11 | i8 | string.cpp:382:12:382:12 | call to operator-= | TAINT |
780794
| string.cpp:382:12:382:12 | call to operator-= | string.cpp:382:8:382:8 | call to operator* | TAINT |
781795
| string.cpp:382:14:382:14 | 1 | string.cpp:382:10:382:11 | ref arg i8 | TAINT |
782796
| string.cpp:382:14:382:14 | 1 | string.cpp:382:12:382:12 | call to operator-= | |
@@ -1624,6 +1638,7 @@
16241638
| vector.cpp:12:21:12:28 | call to vector | vector.cpp:18:55:18:55 | v | |
16251639
| vector.cpp:12:21:12:28 | call to vector | vector.cpp:22:15:22:15 | v | |
16261640
| vector.cpp:14:14:14:14 | (__begin) | vector.cpp:14:14:14:14 | call to operator* | TAINT |
1641+
| vector.cpp:14:14:14:14 | (__begin) | vector.cpp:14:14:14:14 | call to operator++ | TAINT |
16271642
| vector.cpp:14:14:14:14 | call to begin | vector.cpp:14:14:14:14 | (__begin) | |
16281643
| vector.cpp:14:14:14:14 | call to begin | vector.cpp:14:14:14:14 | (__begin) | |
16291644
| vector.cpp:14:14:14:14 | call to begin | vector.cpp:14:14:14:14 | (__begin) | |
@@ -1643,11 +1658,13 @@
16431658
| vector.cpp:18:40:18:44 | call to begin | vector.cpp:19:9:19:10 | it | |
16441659
| vector.cpp:18:55:18:55 | ref arg v | vector.cpp:18:55:18:55 | v | |
16451660
| vector.cpp:18:55:18:55 | ref arg v | vector.cpp:22:15:22:15 | v | |
1661+
| vector.cpp:18:66:18:67 | it | vector.cpp:18:64:18:64 | call to operator++ | TAINT |
16461662
| vector.cpp:18:66:18:67 | ref arg it | vector.cpp:18:49:18:50 | it | |
16471663
| vector.cpp:18:66:18:67 | ref arg it | vector.cpp:18:66:18:67 | it | |
16481664
| vector.cpp:18:66:18:67 | ref arg it | vector.cpp:19:9:19:10 | it | |
16491665
| vector.cpp:19:9:19:10 | it | vector.cpp:19:8:19:8 | call to operator* | TAINT |
16501666
| vector.cpp:22:15:22:15 | (__begin) | vector.cpp:22:15:22:15 | call to operator* | TAINT |
1667+
| vector.cpp:22:15:22:15 | (__begin) | vector.cpp:22:15:22:15 | call to operator++ | TAINT |
16511668
| vector.cpp:22:15:22:15 | call to begin | vector.cpp:22:15:22:15 | (__begin) | |
16521669
| vector.cpp:22:15:22:15 | call to begin | vector.cpp:22:15:22:15 | (__begin) | |
16531670
| vector.cpp:22:15:22:15 | call to begin | vector.cpp:22:15:22:15 | (__begin) | |
@@ -1663,6 +1680,7 @@
16631680
| vector.cpp:26:33:26:39 | source1 | vector.cpp:26:33:26:40 | call to vector | TAINT |
16641681
| vector.cpp:26:33:26:40 | call to vector | vector.cpp:27:21:27:27 | const_v | |
16651682
| vector.cpp:27:21:27:21 | (__begin) | vector.cpp:27:21:27:21 | call to operator* | TAINT |
1683+
| vector.cpp:27:21:27:21 | (__begin) | vector.cpp:27:21:27:21 | call to operator++ | TAINT |
16661684
| vector.cpp:27:21:27:21 | call to begin | vector.cpp:27:21:27:21 | (__begin) | |
16671685
| vector.cpp:27:21:27:21 | call to begin | vector.cpp:27:21:27:21 | (__begin) | |
16681686
| vector.cpp:27:21:27:21 | call to begin | vector.cpp:27:21:27:21 | (__begin) | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,14 @@
9595
| string.cpp:334:11:334:16 | call to append | string.cpp:329:18:329:23 | call to source |
9696
| string.cpp:353:8:353:8 | call to operator* | string.cpp:345:18:345:23 | call to source |
9797
| string.cpp:354:13:354:13 | call to operator[] | string.cpp:345:18:345:23 | call to source |
98+
| string.cpp:367:8:367:8 | call to operator* | string.cpp:360:18:360:23 | call to source |
99+
| string.cpp:368:8:368:8 | call to operator* | string.cpp:360:18:360:23 | call to source |
100+
| string.cpp:370:8:370:8 | call to operator* | string.cpp:360:18:360:23 | call to source |
101+
| string.cpp:372:8:372:8 | call to operator* | string.cpp:360:18:360:23 | call to source |
98102
| string.cpp:375:8:375:8 | call to operator* | string.cpp:360:18:360:23 | call to source |
99103
| string.cpp:378:8:378:8 | call to operator* | string.cpp:360:18:360:23 | call to source |
104+
| string.cpp:380:8:380:8 | call to operator* | string.cpp:360:18:360:23 | call to source |
105+
| string.cpp:382:8:382:8 | call to operator* | string.cpp:360:18:360:23 | call to source |
100106
| structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
101107
| structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
102108
| structlikeclass.cpp:37:8:37:9 | s3 | structlikeclass.cpp:29:22:29:27 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,8 +92,14 @@
9292
| string.cpp:334:11:334:16 | string.cpp:329:18:329:23 | AST only |
9393
| string.cpp:353:8:353:8 | string.cpp:345:18:345:23 | AST only |
9494
| string.cpp:354:13:354:13 | string.cpp:345:18:345:23 | AST only |
95+
| string.cpp:367:8:367:8 | string.cpp:360:18:360:23 | AST only |
96+
| string.cpp:368:8:368:8 | string.cpp:360:18:360:23 | AST only |
97+
| string.cpp:370:8:370:8 | string.cpp:360:18:360:23 | AST only |
98+
| string.cpp:372:8:372:8 | string.cpp:360:18:360:23 | AST only |
9599
| string.cpp:375:8:375:8 | string.cpp:360:18:360:23 | AST only |
96100
| string.cpp:378:8:378:8 | string.cpp:360:18:360:23 | AST only |
101+
| string.cpp:380:8:380:8 | string.cpp:360:18:360:23 | AST only |
102+
| string.cpp:382:8:382:8 | string.cpp:360:18:360:23 | AST only |
97103
| structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |
98104
| structlikeclass.cpp:36:8:36:9 | structlikeclass.cpp:30:24:30:29 | AST only |
99105
| structlikeclass.cpp:37:8:37:9 | structlikeclass.cpp:29:22:29:27 | AST only |

0 commit comments

Comments
 (0)