Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d41ea6c

Browse files
geoffw0geoffw0
authored
Merge pull request #5081 from MathiasVP/indirection-in-dataflow-models
C++: Add more indirection flow in dataflow models
2 parents 26288ad + 5561558 commit d41ea6c

6 files changed

Lines changed: 40 additions & 25 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -740,27 +740,6 @@ private predicate modelFlow(Operand opFrom, Instruction iTo) {
740740
)
741741
)
742742
)
743-
or
744-
impliedModelFlow(opFrom, iTo)
745-
}
746-
747-
/**
748-
* When a `DataFlowFunction` specifies dataflow from a parameter `p` to the return value there should
749-
* also be dataflow from the parameter dereference (i.e., `*p`) to the return value dereference.
750-
*/
751-
private predicate impliedModelFlow(Operand opFrom, Instruction iTo) {
752-
exists(
753-
CallInstruction call, DataFlowFunction func, FunctionInput modelIn, FunctionOutput modelOut,
754-
int index
755-
|
756-
call.getStaticCallTarget() = func and
757-
func.hasDataFlow(modelIn, modelOut)
758-
|
759-
modelIn.isParameterOrQualifierAddress(index) and
760-
modelOut.isReturnValue() and
761-
opFrom = getSideEffectFor(call, index).(ReadSideEffectInstruction).getSideEffectOperand() and
762-
iTo = call // TODO: Add write side effects for return values
763-
)
764743
}
765744

766745
/**

‎cpp/ql/src/semmle/code/cpp/models/implementations/IdentityFunction.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,5 +32,7 @@ private class IdentityFunction extends DataFlowFunction, SideEffectFunction, Ali
3232
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
3333
// These functions simply return the argument value.
3434
input.isParameter(0) and output.isReturnValue()
35+
or
36+
input.isParameterDeref(0) and output.isReturnValueDeref()
3537
}
3638
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,8 @@ private class IteratorCrementOperator extends Operator, DataFlowFunction {
109109
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
110110
input = iteratorInput and
111111
output.isReturnValue()
112+
or
113+
input.isParameterDeref(0) and output.isReturnValueDeref()
112114
}
113115
}
114116

@@ -159,6 +161,8 @@ private class IteratorAssignArithmeticOperator extends Operator, DataFlowFunctio
159161
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
160162
input.isParameter(0) and
161163
output.isReturnValue()
164+
or
165+
input.isParameterDeref(0) and output.isReturnValueDeref()
162166
}
163167

164168
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -201,6 +205,9 @@ private class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunc
201205
or
202206
input.isReturnValueDeref() and
203207
output.isQualifierObject()
208+
or
209+
input.isQualifierObject() and
210+
output.isReturnValueDeref()
204211
}
205212

206213
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,7 @@ class StdVectorEmplace extends TaintFunction {
193193
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
194194
// flow from any parameter except the position iterator to qualifier and return value
195195
// (here we assume taint flow from any constructor parameter to the constructed object)
196-
input.isParameter([1 .. getNumberOfParameters() - 1]) and
196+
input.isParameterDeref([1 .. getNumberOfParameters() - 1]) and
197197
(
198198
output.isQualifierObject() or
199199
output.isReturnValue()
@@ -210,7 +210,7 @@ class StdVectorEmplaceBack extends TaintFunction {
210210
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
211211
// flow from any parameter to qualifier
212212
// (here we assume taint flow from any constructor parameter to the constructed object)
213-
input.isParameter([0 .. getNumberOfParameters() - 1]) and
213+
input.isParameterDeref([0 .. getNumberOfParameters() - 1]) and
214214
output.isQualifierObject()
215215
}
216216
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,9 @@ private class StdIStreamIn extends DataFlowFunction, TaintFunction {
293293
// returns reference to `*this`
294294
input.isQualifierAddress() and
295295
output.isReturnValue()
296+
or
297+
input.isQualifierObject() and
298+
output.isReturnValueDeref()
296299
}
297300

298301
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -319,6 +322,9 @@ private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
319322
// flow from first parameter to return value
320323
input.isParameter(0) and
321324
output.isReturnValue()
325+
or
326+
input.isParameterDeref(0) and
327+
output.isReturnValueDeref()
322328
}
323329

324330
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -361,6 +367,9 @@ private class StdIStreamRead extends DataFlowFunction, TaintFunction {
361367
// returns reference to `*this`
362368
input.isQualifierAddress() and
363369
output.isReturnValue()
370+
or
371+
input.isQualifierObject() and
372+
output.isReturnValueDeref()
364373
}
365374

366375
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -397,6 +406,9 @@ private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
397406
// returns reference to `*this`
398407
input.isQualifierAddress() and
399408
output.isReturnValue()
409+
or
410+
input.isQualifierObject() and
411+
output.isReturnValueDeref()
400412
}
401413

402414
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -430,6 +442,9 @@ private class StdIStreamGetLine extends DataFlowFunction, TaintFunction {
430442
// returns reference to `*this`
431443
input.isQualifierAddress() and
432444
output.isReturnValue()
445+
or
446+
input.isQualifierObject() and
447+
output.isReturnValueDeref()
433448
}
434449

435450
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -453,6 +468,9 @@ private class StdGetLine extends DataFlowFunction, TaintFunction {
453468
// flow from first parameter to return value
454469
input.isParameter(0) and
455470
output.isReturnValue()
471+
or
472+
input.isParameterDeref(0) and
473+
output.isReturnValueDeref()
456474
}
457475

458476
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -486,6 +504,9 @@ private class StdOStreamOut extends DataFlowFunction, TaintFunction {
486504
// returns reference to `*this`
487505
input.isQualifierAddress() and
488506
output.isReturnValue()
507+
or
508+
input.isQualifierObject() and
509+
output.isReturnValueDeref()
489510
}
490511

491512
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -522,6 +543,9 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
522543
// flow from first parameter to return value
523544
input.isParameter(0) and
524545
output.isReturnValue()
546+
or
547+
input.isParameterDeref(0) and
548+
output.isReturnValueDeref()
525549
}
526550

527551
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -605,6 +629,9 @@ private class StdStreamFunction extends DataFlowFunction, TaintFunction {
605629
// returns reference to `*this`
606630
input.isQualifierAddress() and
607631
output.isReturnValue()
632+
or
633+
input.isQualifierObject() and
634+
output.isReturnValueDeref()
608635
}
609636

610637
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -491,8 +491,8 @@ void test_vector_emplace() {
491491
std::vector<int> v1(10), v2(10);
492492

493493
v1.emplace_back(source());
494-
sink(v1); // $ ast MISSING: ir
494+
sink(v1); // $ ast,ir
495495

496496
v2.emplace(v2.begin(), source());
497-
sink(v2); // $ ast MISSING: ir
497+
sink(v2); // $ ast,ir
498498
}

0 commit comments

Comments
 (0)