Skip to content

Commit 0af62b8

Browse files
authored
Merge pull request #4515 from geoffw0/modelchanges1
C++: Changes to models library.
2 parents 64dcfbd + c8783b5 commit 0af62b8

File tree

3 files changed

+10
-54
lines changed

3 files changed

+10
-54
lines changed

cpp/ql/src/semmle/code/cpp/models/implementations/Pure.qll

Lines changed: 7 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -5,32 +5,9 @@ import semmle.code.cpp.models.interfaces.SideEffect
55

66
class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, SideEffectFunction {
77
PureStrFunction() {
8-
exists(string name |
9-
hasGlobalOrStdName(name) and
10-
(
11-
name = "atof" or
12-
name = "atoi" or
13-
name = "atol" or
14-
name = "atoll" or
15-
name = "strcasestr" or
16-
name = "strchnul" or
17-
name = "strchr" or
18-
name = "strchrnul" or
19-
name = "strstr" or
20-
name = "strpbrk" or
21-
name = "strcmp" or
22-
name = "strcspn" or
23-
name = "strncmp" or
24-
name = "strrchr" or
25-
name = "strspn" or
26-
name = "strtod" or
27-
name = "strtof" or
28-
name = "strtol" or
29-
name = "strtoll" or
30-
name = "strtoq" or
31-
name = "strtoul"
32-
)
33-
)
8+
hasGlobalOrStdName(["atof", "atoi", "atol", "atoll", "strcasestr", "strchnul", "strchr",
9+
"strchrnul", "strstr", "strpbrk", "strcmp", "strcspn", "strncmp", "strrchr", "strspn",
10+
"strtod", "strtof", "strtol", "strtoll", "strtoq", "strtoul"])
3411
}
3512

3613
override predicate hasArrayInput(int bufParam) {
@@ -81,22 +58,9 @@ class PureStrFunction extends AliasFunction, ArrayFunction, TaintFunction, SideE
8158

8259
class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFunction {
8360
StrLenFunction() {
84-
exists(string name |
85-
hasGlobalOrStdName(name) and
86-
(
87-
name = "strlen" or
88-
name = "strnlen" or
89-
name = "wcslen"
90-
)
91-
or
92-
hasGlobalName(name) and
93-
(
94-
name = "_mbslen" or
95-
name = "_mbslen_l" or
96-
name = "_mbstrlen" or
97-
name = "_mbstrlen_l"
98-
)
99-
)
61+
hasGlobalOrStdName(["strlen", "strnlen", "wcslen"])
62+
or
63+
hasGlobalName(["_mbslen", "_mbslen_l", "_mbstrlen", "_mbstrlen_l"])
10064
}
10165

10266
override predicate hasArrayInput(int bufParam) {
@@ -126,15 +90,7 @@ class StrLenFunction extends AliasFunction, ArrayFunction, SideEffectFunction {
12690
}
12791

12892
class PureFunction extends TaintFunction, SideEffectFunction {
129-
PureFunction() {
130-
exists(string name |
131-
hasGlobalOrStdName(name) and
132-
(
133-
name = "abs" or
134-
name = "labs"
135-
)
136-
)
137-
}
93+
PureFunction() { hasGlobalOrStdName(["abs", "labs"]) }
13894

13995
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
14096
exists(ParameterIndex i |

cpp/ql/src/semmle/code/cpp/models/implementations/SmartPointer.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ class MakeUniqueOrShared extends TaintFunction {
1717
// Exclude the specializations of `std::make_shared` and `std::make_unique` that allocate arrays
1818
// since these just take a size argument, which we don't want to propagate taint through.
1919
not this.isArray() and
20-
input.isParameter(_) and
20+
input.isParameter([0 .. getNumberOfParameters() - 1]) and
2121
output.isReturnValue()
2222
}
2323

cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.Taint
77
/**
88
* Additional model for `std::pair` constructors.
99
*/
10-
class StdPairConstructor extends Constructor, TaintFunction {
10+
private class StdPairConstructor extends Constructor, TaintFunction {
1111
StdPairConstructor() { this.hasQualifiedName("std", "pair", "pair") }
1212

1313
/**
@@ -34,7 +34,7 @@ class StdPairConstructor extends Constructor, TaintFunction {
3434
/**
3535
* The standard pair `swap` function.
3636
*/
37-
class StdPairSwap extends TaintFunction {
37+
private class StdPairSwap extends TaintFunction {
3838
StdPairSwap() { this.hasQualifiedName("std", "pair", "swap") }
3939

4040
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {

0 commit comments

Comments
 (0)