|
| 1 | +/** |
| 2 | + * Provides implementation classes modeling `sscanf`, `fscanf` and various similar |
| 3 | + * functions. See `semmle.code.cpp.models.Models` for usage information. |
| 4 | + */ |
| 5 | + |
| 6 | +import semmle.code.cpp.Function |
| 7 | +import semmle.code.cpp.models.interfaces.ArrayFunction |
| 8 | +import semmle.code.cpp.models.interfaces.Taint |
| 9 | +import semmle.code.cpp.models.interfaces.Alias |
| 10 | +import semmle.code.cpp.models.interfaces.SideEffect |
| 11 | + |
| 12 | +/** |
| 13 | + * The standard function `sscanf`, `fscanf` and its assorted variants |
| 14 | + */ |
| 15 | +private class Sscanf extends ArrayFunction, TaintFunction, AliasFunction, SideEffectFunction { |
| 16 | + Sscanf() { |
| 17 | + this.hasGlobalOrStdName([ |
| 18 | + "sscanf", // sscanf(src_stream, format, args...) |
| 19 | + "swscanf", // swscanf(src, format, args...) |
| 20 | + "fscanf", // fscanf(src_stream, format, args...) |
| 21 | + "fwscanf" // fwscanf(src_stream, format, args...) |
| 22 | + ]) or |
| 23 | + this.hasGlobalName([ |
| 24 | + "_sscanf_l", // _sscanf_l(src, format, locale, args...) |
| 25 | + "_swscanf_l", // _swscanf_l(src, format, locale, args...) |
| 26 | + "_snscanf", // _snscanf(src, length, format, args...) |
| 27 | + "_snscanf_l", // _snscanf_l(src, length, format, locale, args...) |
| 28 | + "_snwscanf", // _snwscanf(src, length, format, args...) |
| 29 | + "_snwscanf_l", // _snwscanf_l(src, length, format, locale, args...) |
| 30 | + "_fscanf_l", // _fscanf_l(src_stream, format, locale, args...) |
| 31 | + "_fwscanf_l" // _fwscanf_l(src_stream, format, locale, args...) |
| 32 | + ]) |
| 33 | + } |
| 34 | + |
| 35 | + override predicate hasArrayWithNullTerminator(int bufParam) { |
| 36 | + bufParam = [0, getFormatPosition()] |
| 37 | + } |
| 38 | + |
| 39 | + override predicate hasArrayInput(int bufParam) { bufParam = [0, getFormatPosition()] } |
| 40 | + |
| 41 | + private int getLengthPosition() { |
| 42 | + this.getName().matches("\\_sn%") and |
| 43 | + result = 1 |
| 44 | + } |
| 45 | + |
| 46 | + private int getLocalePosition() { |
| 47 | + this.getName().matches("%\\_l") and |
| 48 | + (if exists(getLengthPosition()) then result = getLengthPosition() + 2 else result = 2) |
| 49 | + } |
| 50 | + |
| 51 | + private int getFormatPosition() { if exists(getLengthPosition()) then result = 2 else result = 1 } |
| 52 | + |
| 53 | + private int getArgsStartPosition() { |
| 54 | + exists(int nLength, int nLocale | |
| 55 | + (if exists(getLocalePosition()) then nLocale = 1 else nLocale = 0) and |
| 56 | + (if exists(getLengthPosition()) then nLength = 1 else nLength = 0) and |
| 57 | + result = 2 + nLocale + nLength |
| 58 | + ) |
| 59 | + } |
| 60 | + |
| 61 | + override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) { |
| 62 | + input.isParameterDeref(0) and |
| 63 | + output.isParameterDeref(any(int i | i >= getArgsStartPosition())) |
| 64 | + } |
| 65 | + |
| 66 | + override predicate parameterNeverEscapes(int index) { |
| 67 | + index = [0 .. max(getACallToThisFunction().getNumberOfArguments())] |
| 68 | + } |
| 69 | + |
| 70 | + override predicate parameterEscapesOnlyViaReturn(int index) { none() } |
| 71 | + |
| 72 | + override predicate parameterIsAlwaysReturned(int index) { none() } |
| 73 | + |
| 74 | + override predicate hasOnlySpecificReadSideEffects() { any() } |
| 75 | + |
| 76 | + override predicate hasOnlySpecificWriteSideEffects() { any() } |
| 77 | + |
| 78 | + override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) { |
| 79 | + i >= getArgsStartPosition() and |
| 80 | + buffer = true and |
| 81 | + mustWrite = true |
| 82 | + } |
| 83 | + |
| 84 | + override predicate hasSpecificReadSideEffect(ParameterIndex i, boolean buffer) { |
| 85 | + buffer = true and |
| 86 | + i = [0, getFormatPosition(), getLocalePosition()] |
| 87 | + } |
| 88 | +} |
0 commit comments