Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit dd53e3f

Browse files
geoffw0geoffw0
committed
C++: Fix data flow to return value.
1 parent 597757d commit dd53e3f

6 files changed

Lines changed: 32 additions & 8 deletions

File tree

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -629,14 +629,21 @@ private predicate exprToExprStep_nocfg(Expr fromExpr, Expr toExpr) {
629629
// `ClassAggregateLiteral` (`{ capture1, ..., captureN }`).
630630
toExpr.(LambdaExpression).getInitializer() = fromExpr
631631
or
632+
// Data flow through a function model.
632633
toExpr =
633634
any(Call call |
634-
exists(DataFlowFunction f, FunctionInput inModel, FunctionOutput outModel, int iIn |
635-
call.getTarget() = f and
635+
exists(DataFlowFunction f, FunctionInput inModel, FunctionOutput outModel |
636636
f.hasDataFlow(inModel, outModel) and
637-
outModel.isReturnValue() and
638-
inModel.isParameter(iIn) and
639-
fromExpr = call.getArgument(iIn)
637+
(
638+
exists(int iIn |
639+
inModel.isParameter(iIn) and
640+
fromExpr = call.getArgument(iIn)
641+
) or
642+
inModel.isQualifierObject() and
643+
fromExpr = call.getQualifier()
644+
) and
645+
call.getTarget() = f and
646+
outModel.isReturnValue()
640647
)
641648
)
642649
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -304,7 +304,7 @@ class StdOStreamOut extends DataFlowFunction, TaintFunction {
304304

305305
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
306306
// flow from qualifier to return value
307-
input.isQualifierAddress() and
307+
input.isQualifierObject() and
308308
output.isReturnValue()
309309
}
310310

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1449,30 +1449,40 @@
14491449
| stringstream.cpp:51:10:51:14 | abc | stringstream.cpp:51:10:51:14 | call to basic_string | TAINT |
14501450
| stringstream.cpp:51:10:51:14 | call to basic_string | stringstream.cpp:51:2:51:4 | ref arg ss7 | TAINT |
14511451
| stringstream.cpp:55:7:55:9 | ref arg ss8 | stringstream.cpp:58:7:58:9 | ss8 | |
1452+
| stringstream.cpp:55:7:55:9 | ss8 | stringstream.cpp:55:11:55:13 | call to put | |
14521453
| stringstream.cpp:55:15:55:17 | 97 | stringstream.cpp:55:7:55:9 | ref arg ss8 | TAINT |
14531454
| stringstream.cpp:55:15:55:17 | 97 | stringstream.cpp:55:11:55:13 | call to put | TAINT |
14541455
| stringstream.cpp:56:7:56:9 | ref arg ss9 | stringstream.cpp:59:7:59:9 | ss9 | |
1456+
| stringstream.cpp:56:7:56:9 | ss9 | stringstream.cpp:56:11:56:13 | call to put | |
14551457
| stringstream.cpp:56:15:56:29 | call to source | stringstream.cpp:56:7:56:9 | ref arg ss9 | TAINT |
14561458
| stringstream.cpp:56:15:56:29 | call to source | stringstream.cpp:56:11:56:13 | call to put | TAINT |
14571459
| stringstream.cpp:57:7:57:10 | ref arg ss10 | stringstream.cpp:60:7:60:10 | ss10 | |
1460+
| stringstream.cpp:57:7:57:10 | ss10 | stringstream.cpp:57:12:57:14 | call to put | |
1461+
| stringstream.cpp:57:12:57:14 | call to put | stringstream.cpp:57:21:57:23 | call to put | |
14581462
| stringstream.cpp:57:12:57:14 | ref arg call to put | stringstream.cpp:57:7:57:10 | ref arg ss10 | TAINT |
14591463
| stringstream.cpp:57:16:57:18 | 97 | stringstream.cpp:57:7:57:10 | ref arg ss10 | TAINT |
14601464
| stringstream.cpp:57:16:57:18 | 97 | stringstream.cpp:57:12:57:14 | call to put | TAINT |
1465+
| stringstream.cpp:57:21:57:23 | call to put | stringstream.cpp:57:44:57:46 | call to put | |
14611466
| stringstream.cpp:57:21:57:23 | ref arg call to put | stringstream.cpp:57:12:57:14 | ref arg call to put | TAINT |
14621467
| stringstream.cpp:57:25:57:39 | call to source | stringstream.cpp:57:12:57:14 | ref arg call to put | TAINT |
14631468
| stringstream.cpp:57:25:57:39 | call to source | stringstream.cpp:57:21:57:23 | call to put | TAINT |
14641469
| stringstream.cpp:57:48:57:50 | 122 | stringstream.cpp:57:21:57:23 | ref arg call to put | TAINT |
14651470
| stringstream.cpp:57:48:57:50 | 122 | stringstream.cpp:57:44:57:46 | call to put | TAINT |
14661471
| stringstream.cpp:62:7:62:10 | ref arg ss11 | stringstream.cpp:65:7:65:10 | ss11 | |
1472+
| stringstream.cpp:62:7:62:10 | ss11 | stringstream.cpp:62:12:62:16 | call to write | |
14671473
| stringstream.cpp:62:18:62:24 | begin | stringstream.cpp:62:7:62:10 | ref arg ss11 | TAINT |
14681474
| stringstream.cpp:62:18:62:24 | begin | stringstream.cpp:62:12:62:16 | call to write | TAINT |
14691475
| stringstream.cpp:63:7:63:10 | ref arg ss12 | stringstream.cpp:66:7:66:10 | ss12 | |
1476+
| stringstream.cpp:63:7:63:10 | ss12 | stringstream.cpp:63:12:63:16 | call to write | |
14701477
| stringstream.cpp:63:18:63:23 | call to source | stringstream.cpp:63:7:63:10 | ref arg ss12 | TAINT |
14711478
| stringstream.cpp:63:18:63:23 | call to source | stringstream.cpp:63:12:63:16 | call to write | TAINT |
14721479
| stringstream.cpp:64:7:64:10 | ref arg ss13 | stringstream.cpp:67:7:67:10 | ss13 | |
1480+
| stringstream.cpp:64:7:64:10 | ss13 | stringstream.cpp:64:12:64:16 | call to write | |
1481+
| stringstream.cpp:64:12:64:16 | call to write | stringstream.cpp:64:30:64:34 | call to write | |
14731482
| stringstream.cpp:64:12:64:16 | ref arg call to write | stringstream.cpp:64:7:64:10 | ref arg ss13 | TAINT |
14741483
| stringstream.cpp:64:18:64:24 | begin | stringstream.cpp:64:7:64:10 | ref arg ss13 | TAINT |
14751484
| stringstream.cpp:64:18:64:24 | begin | stringstream.cpp:64:12:64:16 | call to write | TAINT |
1485+
| stringstream.cpp:64:30:64:34 | call to write | stringstream.cpp:64:54:64:58 | call to write | |
14761486
| stringstream.cpp:64:30:64:34 | ref arg call to write | stringstream.cpp:64:12:64:16 | ref arg call to write | TAINT |
14771487
| stringstream.cpp:64:36:64:41 | call to source | stringstream.cpp:64:12:64:16 | ref arg call to write | TAINT |
14781488
| stringstream.cpp:64:36:64:41 | call to source | stringstream.cpp:64:30:64:34 | call to write | TAINT |
@@ -1494,11 +1504,13 @@
14941504
| stringstream.cpp:75:7:75:9 | ref arg ss1 | stringstream.cpp:77:7:77:9 | ss1 | |
14951505
| stringstream.cpp:75:7:75:9 | ref arg ss1 | stringstream.cpp:80:7:80:9 | ss1 | |
14961506
| stringstream.cpp:75:7:75:9 | ref arg ss1 | stringstream.cpp:82:7:82:9 | ss1 | |
1507+
| stringstream.cpp:75:7:75:9 | ss1 | stringstream.cpp:75:11:75:11 | call to operator<< | |
14971508
| stringstream.cpp:75:14:75:17 | 1234 | stringstream.cpp:75:7:75:9 | ref arg ss1 | TAINT |
14981509
| stringstream.cpp:75:14:75:17 | 1234 | stringstream.cpp:75:11:75:11 | call to operator<< | TAINT |
14991510
| stringstream.cpp:76:7:76:9 | ref arg ss2 | stringstream.cpp:78:7:78:9 | ss2 | |
15001511
| stringstream.cpp:76:7:76:9 | ref arg ss2 | stringstream.cpp:81:7:81:9 | ss2 | |
15011512
| stringstream.cpp:76:7:76:9 | ref arg ss2 | stringstream.cpp:83:7:83:9 | ss2 | |
1513+
| stringstream.cpp:76:7:76:9 | ss2 | stringstream.cpp:76:11:76:11 | call to operator<< | |
15021514
| stringstream.cpp:76:14:76:19 | source | stringstream.cpp:76:7:76:9 | ref arg ss2 | TAINT |
15031515
| stringstream.cpp:76:14:76:19 | source | stringstream.cpp:76:11:76:11 | call to operator<< | TAINT |
15041516
| stringstream.cpp:77:7:77:9 | ref arg ss1 | stringstream.cpp:80:7:80:9 | ss1 | |
@@ -1761,6 +1773,7 @@
17611773
| stringstream.cpp:192:7:192:8 | ref arg ss | stringstream.cpp:195:7:195:8 | ss | |
17621774
| stringstream.cpp:192:7:192:8 | ref arg ss | stringstream.cpp:196:7:196:8 | ss | |
17631775
| stringstream.cpp:192:7:192:8 | ref arg ss | stringstream.cpp:197:7:197:8 | ss | |
1776+
| stringstream.cpp:192:7:192:8 | ss | stringstream.cpp:192:10:192:12 | call to put | |
17641777
| stringstream.cpp:192:14:192:16 | 97 | stringstream.cpp:192:7:192:8 | ref arg ss | TAINT |
17651778
| stringstream.cpp:192:14:192:16 | 97 | stringstream.cpp:192:10:192:12 | call to put | TAINT |
17661779
| stringstream.cpp:193:7:193:8 | ref arg ss | stringstream.cpp:194:7:194:8 | ss | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,14 @@ void test_stringstream_string(int amount)
5454

5555
sink(ss8.put('a'));
5656
sink(ss9.put(ns_char::source())); // tainted
57-
sink(ss10.put('a').put(ns_char::source()).put('z')); // tainted [NOT DETECTED]
57+
sink(ss10.put('a').put(ns_char::source()).put('z')); // tainted
5858
sink(ss8);
5959
sink(ss9); // tainted
6060
sink(ss10); // tainted
6161

6262
sink(ss11.write("begin", 5));
6363
sink(ss12.write(source(), 5)); // tainted
64-
sink(ss13.write("begin", 5).write(source(), amount).write("end", 3)); // tainted [NOT DETECTED]
64+
sink(ss13.write("begin", 5).write(source(), amount).write("end", 3)); // tainted
6565
sink(ss11);
6666
sink(ss12); // tainted
6767
sink(ss13); // tainted

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,9 +171,11 @@
171171
| stringstream.cpp:52:7:52:9 | ss6 | stringstream.cpp:49:10:49:15 | call to source |
172172
| stringstream.cpp:53:7:53:9 | ss7 | stringstream.cpp:50:10:50:15 | call to source |
173173
| stringstream.cpp:56:11:56:13 | call to put | stringstream.cpp:56:15:56:29 | call to source |
174+
| stringstream.cpp:57:44:57:46 | call to put | stringstream.cpp:57:25:57:39 | call to source |
174175
| stringstream.cpp:59:7:59:9 | ss9 | stringstream.cpp:56:15:56:29 | call to source |
175176
| stringstream.cpp:60:7:60:10 | ss10 | stringstream.cpp:57:25:57:39 | call to source |
176177
| stringstream.cpp:63:12:63:16 | call to write | stringstream.cpp:63:18:63:23 | call to source |
178+
| stringstream.cpp:64:54:64:58 | call to write | stringstream.cpp:64:36:64:41 | call to source |
177179
| stringstream.cpp:66:7:66:10 | ss12 | stringstream.cpp:63:18:63:23 | call to source |
178180
| stringstream.cpp:67:7:67:10 | ss13 | stringstream.cpp:64:36:64:41 | call to source |
179181
| stringstream.cpp:76:11:76:11 | call to operator<< | stringstream.cpp:70:32:70:37 | source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,9 +187,11 @@
187187
| stringstream.cpp:52:7:52:9 | stringstream.cpp:49:10:49:15 | AST only |
188188
| stringstream.cpp:53:7:53:9 | stringstream.cpp:50:10:50:15 | AST only |
189189
| stringstream.cpp:56:11:56:13 | stringstream.cpp:56:15:56:29 | AST only |
190+
| stringstream.cpp:57:44:57:46 | stringstream.cpp:57:25:57:39 | AST only |
190191
| stringstream.cpp:59:7:59:9 | stringstream.cpp:56:15:56:29 | AST only |
191192
| stringstream.cpp:60:7:60:10 | stringstream.cpp:57:25:57:39 | AST only |
192193
| stringstream.cpp:63:12:63:16 | stringstream.cpp:63:18:63:23 | AST only |
194+
| stringstream.cpp:64:54:64:58 | stringstream.cpp:64:36:64:41 | AST only |
193195
| stringstream.cpp:66:7:66:10 | stringstream.cpp:63:18:63:23 | AST only |
194196
| stringstream.cpp:67:7:67:10 | stringstream.cpp:64:36:64:41 | AST only |
195197
| stringstream.cpp:76:11:76:11 | stringstream.cpp:70:32:70:37 | AST only |

0 commit comments

Comments
 (0)