Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit d9f6895

Browse files
geoffw0geoffw0
committed
CPP: 'sometimes copying' is considered data flow.
1 parent 2c7e2c4 commit d9f6895

7 files changed

Lines changed: 13 additions & 31 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll‎

Lines changed: 6 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -47,20 +47,11 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction {
4747
}
4848

4949
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
50-
(
51-
// These always copy the full value of the input buffer to the output
52-
// buffer
53-
this.hasName("strcpy") or
54-
this.hasName("_mbscpy") or
55-
this.hasName("wcscpy")
56-
) and
57-
(
58-
input.isParameterDeref(1) and
59-
output.isParameterDeref(0)
60-
or
61-
input.isParameterDeref(1) and
62-
output.isReturnValueDeref()
63-
)
50+
input.isParameterDeref(1) and
51+
output.isParameterDeref(0)
52+
or
53+
input.isParameterDeref(1) and
54+
output.isReturnValueDeref()
6455
or
6556
input.isParameter(0) and
6657
output.isReturnValue()
@@ -77,10 +68,7 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction {
7768
this.hasName("wcsncpy") or
7869
this.hasName("_wcsncpy_l")
7970
) and
80-
(
81-
input.isParameter(2) or
82-
input.isParameterDeref(1)
83-
) and
71+
input.isParameter(2) and
8472
(
8573
output.isParameterDeref(0) or
8674
output.isReturnValueDeref()

‎cpp/ql/src/semmle/code/cpp/models/implementations/Strdup.qll‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,6 @@ class StrdupFunction extends AllocationFunction, ArrayFunction, DataFlowFunction
3434
override predicate hasArrayWithNullTerminator(int bufParam) { bufParam = 0 }
3535

3636
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
37-
// These always copy the full value of the input buffer to the result
38-
// buffer
3937
input.isParameterDeref(0) and
4038
output.isReturnValueDeref()
4139
}
@@ -44,7 +42,7 @@ class StrdupFunction extends AllocationFunction, ArrayFunction, DataFlowFunction
4442
/**
4543
* A `strndup` style allocation function.
4644
*/
47-
class StrndupFunction extends AllocationFunction, ArrayFunction, TaintFunction {
45+
class StrndupFunction extends AllocationFunction, ArrayFunction, DataFlowFunction {
4846
StrndupFunction() {
4947
exists(string name |
5048
hasGlobalName(name) and
@@ -57,9 +55,7 @@ class StrndupFunction extends AllocationFunction, ArrayFunction, TaintFunction {
5755

5856
override predicate hasArrayWithNullTerminator(int bufParam) { bufParam = 0 }
5957

60-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
61-
// This function may do only a partial copy of the input buffer to the output
62-
// buffer, so it's a taint flow.
58+
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
6359
(
6460
input.isParameterDeref(0) or
6561
input.isParameter(1)

‎cpp/ql/src/semmle/code/cpp/models/interfaces/DataFlow.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ import FunctionInputsAndOutputs
1212
import semmle.code.cpp.models.Models
1313

1414
/**
15-
* A library function for which a value is copied from a parameter or qualifier
16-
* to an output buffer, return value, or qualifier.
15+
* A library function for which a value is or may be copied from a parameter
16+
* or qualifier to an output buffer, return value, or qualifier.
1717
*
1818
* Note that this does not include partial copying of values or partial writes
1919
* to destinations; that is covered by `TaintModel.qll`.

‎cpp/ql/src/semmle/code/cpp/models/interfaces/Taint.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@ import semmle.code.cpp.models.Models
1616
* from a parameter or qualifier to an output buffer, return value, or qualifier.
1717
*
1818
* Note that this does not include direct copying of values; that is covered by
19-
* DataFlowModel.qll
19+
* DataFlowModel.qll. If a value is sometimes copied in full, and sometimes
20+
* altered (for example copying a string with `strncpy`), this is also considered
21+
* data flow.
2022
*/
2123
abstract class TaintFunction extends Function {
2224
abstract predicate hasTaintFlow(FunctionInput input, FunctionOutput output);

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -338,12 +338,10 @@
338338
| taint.cpp:371:6:371:12 | call to strndup | taint.cpp:371:2:371:25 | ... = ... | |
339339
| taint.cpp:371:6:371:12 | call to strndup | taint.cpp:374:7:374:7 | c | |
340340
| taint.cpp:371:14:371:19 | source | taint.cpp:371:6:371:12 | call to strndup | TAINT |
341-
| taint.cpp:371:22:371:24 | 100 | taint.cpp:371:6:371:12 | call to strndup | TAINT |
342341
| taint.cpp:377:23:377:28 | source | taint.cpp:381:30:381:35 | source | |
343342
| taint.cpp:381:6:381:12 | call to strndup | taint.cpp:381:2:381:36 | ... = ... | |
344343
| taint.cpp:381:6:381:12 | call to strndup | taint.cpp:382:7:382:7 | a | |
345344
| taint.cpp:381:14:381:27 | hello, world | taint.cpp:381:6:381:12 | call to strndup | TAINT |
346-
| taint.cpp:381:30:381:35 | source | taint.cpp:381:6:381:12 | call to strndup | TAINT |
347345
| taint.cpp:385:27:385:32 | source | taint.cpp:389:13:389:18 | source | |
348346
| taint.cpp:389:6:389:11 | call to wcsdup | taint.cpp:389:2:389:19 | ... = ... | |
349347
| taint.cpp:389:6:389:11 | call to wcsdup | taint.cpp:391:7:391:7 | a | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@
3939
| taint.cpp:352:7:352:7 | b | taint.cpp:330:6:330:11 | call to source |
4040
| taint.cpp:372:7:372:7 | a | taint.cpp:365:24:365:29 | source |
4141
| taint.cpp:374:7:374:7 | c | taint.cpp:365:24:365:29 | source |
42-
| taint.cpp:382:7:382:7 | a | taint.cpp:377:23:377:28 | source |
4342
| taint.cpp:391:7:391:7 | a | taint.cpp:385:27:385:32 | source |
4443
| taint.cpp:423:7:423:7 | a | taint.cpp:422:14:422:19 | call to source |
4544
| taint.cpp:424:9:424:17 | call to getMember | taint.cpp:422:14:422:19 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@
2626
| taint.cpp:352:7:352:7 | taint.cpp:330:6:330:11 | AST only |
2727
| taint.cpp:372:7:372:7 | taint.cpp:365:24:365:29 | AST only |
2828
| taint.cpp:374:7:374:7 | taint.cpp:365:24:365:29 | AST only |
29-
| taint.cpp:382:7:382:7 | taint.cpp:377:23:377:28 | AST only |
3029
| taint.cpp:391:7:391:7 | taint.cpp:385:27:385:32 | AST only |
3130
| taint.cpp:423:7:423:7 | taint.cpp:422:14:422:19 | AST only |
3231
| taint.cpp:424:9:424:17 | taint.cpp:422:14:422:19 | AST only |

0 commit comments

Comments
 (0)