Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c09ed10

Browse files
MathiasVPMathiasVP
authored
Merge pull request #11727 from MathiasVP/fix-crement-and-assign-op-dataflow-mappings
C++: Fix `DataFlow <-> Expr` mappings for `CrementOperation` and `AssignOperation`
2 parents 33649ed + a7aa1a7 commit c09ed10

5 files changed

Lines changed: 42 additions & 2 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -829,9 +829,27 @@ private predicate exprNodeShouldBeIndirectOutNode(IndirectArgumentOutNode node,
829829

830830
/** Holds if `node` should be an instruction node that maps `node.asExpr()` to `e`. */
831831
predicate exprNodeShouldBeInstruction(Node node, Expr e) {
832-
e = node.asInstruction().getConvertedResultExpression() and
833832
not exprNodeShouldBeOperand(_, e) and
834-
not exprNodeShouldBeIndirectOutNode(_, e)
833+
not exprNodeShouldBeIndirectOutNode(_, e) and
834+
(
835+
e = node.asInstruction().getConvertedResultExpression()
836+
or
837+
// The instruction that contains the result of an `AssignOperation` is
838+
// the unloaded left operand (see the comments in `TranslatedAssignOperation`).
839+
// That means that for cases like
840+
// ```cpp
841+
// int x = ...;
842+
// x += 1;
843+
// ```
844+
// the result of `x += 1` is the `VariableAddressInstruction` that represents `x`. But
845+
// that instruction doesn't receive the flow from this `AssignOperation`. So instead we
846+
// map the operation to the `AddInstruction`.
847+
node.asInstruction().getAst() = e.(AssignOperation)
848+
or
849+
// Same story for `CrementOperation`s (cf. the comments in the subclasses
850+
// of `TranslatedCrementOperation`).
851+
node.asInstruction().getAst() = e.(CrementOperation)
852+
)
835853
}
836854

837855
/** Holds if `node` should be an `IndirectInstruction` that maps `node.asIndirectExpr()` to `e`. */

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,21 @@
11
edges
22
| test.cpp:23:20:23:23 | argv | test.cpp:29:13:29:20 | filePath |
33
| test.cpp:23:20:23:23 | argv | test.cpp:29:13:29:20 | filePath |
4+
| test.cpp:23:20:23:23 | argv indirection | test.cpp:29:13:29:20 | filePath |
5+
| test.cpp:23:20:23:23 | argv indirection | test.cpp:29:13:29:20 | filePath |
6+
| test.cpp:23:20:23:23 | argv indirection | test.cpp:29:13:29:20 | filePath |
7+
| test.cpp:23:20:23:23 | argv indirection | test.cpp:29:13:29:20 | filePath |
48
nodes
59
| test.cpp:23:20:23:23 | argv | semmle.label | argv |
10+
| test.cpp:23:20:23:23 | argv indirection | semmle.label | argv indirection |
11+
| test.cpp:23:20:23:23 | argv indirection | semmle.label | argv indirection |
612
| test.cpp:29:13:29:20 | filePath | semmle.label | filePath |
713
| test.cpp:29:13:29:20 | filePath | semmle.label | filePath |
814
subpaths
915
#select
1016
| test.cpp:29:13:29:20 | filePath | test.cpp:23:20:23:23 | argv | test.cpp:29:13:29:20 | filePath | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |
1117
| test.cpp:29:13:29:20 | filePath | test.cpp:23:20:23:23 | argv | test.cpp:29:13:29:20 | filePath | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |
18+
| test.cpp:29:13:29:20 | filePath | test.cpp:23:20:23:23 | argv indirection | test.cpp:29:13:29:20 | filePath | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |
19+
| test.cpp:29:13:29:20 | filePath | test.cpp:23:20:23:23 | argv indirection | test.cpp:29:13:29:20 | filePath | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |
20+
| test.cpp:29:13:29:20 | filePath | test.cpp:23:20:23:23 | argv indirection | test.cpp:29:13:29:20 | filePath | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |
21+
| test.cpp:29:13:29:20 | filePath | test.cpp:23:20:23:23 | argv indirection | test.cpp:29:13:29:20 | filePath | Using user-supplied data in a `wordexp` command, without disabling command substitution, can make code vulnerable to command injection. |

‎cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,9 @@
1212
| test.cpp:65:12:65:39 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1313
| test.cpp:67:10:67:35 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1414
| test.cpp:70:12:70:20 | ... + ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
15+
| test.cpp:76:12:76:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1516
| test.cpp:82:12:82:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
17+
| test.cpp:88:12:88:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1618
| test.cpp:93:12:93:18 | ++ ... | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1719
| test.cpp:100:12:100:16 | hello | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1820
| test.cpp:110:12:110:24 | new[] | The format string argument to printf should be constant to prevent security issues and other potential errors. |

‎cpp/ql/test/query-tests/Likely Bugs/Leap Year/Adding365DaysPerYear/Adding365daysPerYear.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
1+
| test.cpp:173:29:173:51 | ... & ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:170:2:170:47 | ... += ... | ... += ... |
12
| test.cpp:173:29:173:51 | ... & ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:170:16:170:47 | ... * ... | ... * ... |
3+
| test.cpp:174:30:174:45 | ... >> ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:170:2:170:47 | ... += ... | ... += ... |
24
| test.cpp:174:30:174:45 | ... >> ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:170:16:170:47 | ... * ... | ... * ... |
35
| test.cpp:193:15:193:24 | ... / ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:193:15:193:24 | ... / ... | ... / ... |
6+
| test.cpp:217:29:217:51 | ... & ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:214:2:214:47 | ... += ... | ... += ... |
47
| test.cpp:217:29:217:51 | ... & ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:214:16:214:47 | ... * ... | ... * ... |
8+
| test.cpp:218:30:218:45 | ... >> ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:214:2:214:47 | ... += ... | ... += ... |
59
| test.cpp:218:30:218:45 | ... >> ... | An arithmetic operation $@ that uses a constant value of 365 ends up modifying this date/time, without considering leap year scenarios. | test.cpp:214:16:214:47 | ... * ... | ... * ... |

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,10 @@ edges
7777
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
7878
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
7979
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
80+
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
81+
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
82+
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
83+
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
8084
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
8185
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
8286
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
@@ -197,6 +201,8 @@ nodes
197201
| argvLocal.c:135:9:135:12 | ... ++ | semmle.label | ... ++ |
198202
| argvLocal.c:135:9:135:12 | ... ++ | semmle.label | ... ++ |
199203
| argvLocal.c:135:9:135:12 | ... ++ | semmle.label | ... ++ |
204+
| argvLocal.c:135:9:135:12 | ... ++ | semmle.label | ... ++ |
205+
| argvLocal.c:135:9:135:12 | ... ++ | semmle.label | ... ++ |
200206
| argvLocal.c:136:15:136:18 | -- ... | semmle.label | -- ... |
201207
| argvLocal.c:136:15:136:18 | -- ... | semmle.label | -- ... |
202208
| argvLocal.c:136:15:136:18 | -- ... | semmle.label | -- ... |

0 commit comments

Comments
 (0)