Skip to content

Commit 13b15d9

Browse files
geoffw0geoffw0
committed
C++: Model swap.
1 parent 6119bf3 commit 13b15d9

File tree

5 files changed

+44
-4
lines changed

5 files changed

+44
-4
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,19 @@ class StdMapBeginEnd extends TaintFunction {
4040
output.isReturnValue()
4141
}
4242
}
43+
44+
/**
45+
* The standard map `swap` functions.
46+
*/
47+
class StdMapSwap extends TaintFunction {
48+
StdMapSwap() { this.hasQualifiedName("std", ["map", "unordered_map"], "swap") }
49+
50+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
51+
// container1.swap(container2)
52+
input.isQualifierObject() and
53+
output.isParameterDeref(0)
54+
or
55+
input.isParameterDeref(0) and
56+
output.isQualifierObject()
57+
}
58+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -977,15 +977,19 @@
977977
| map.cpp:191:7:191:9 | m16 | map.cpp:191:7:191:9 | call to map | |
978978
| map.cpp:192:7:192:9 | m17 | map.cpp:192:7:192:9 | call to map | |
979979
| map.cpp:193:7:193:9 | m18 | map.cpp:193:7:193:9 | call to map | |
980+
| map.cpp:194:2:194:4 | m15 | map.cpp:194:11:194:13 | ref arg m16 | TAINT |
980981
| map.cpp:194:2:194:4 | ref arg m15 | map.cpp:196:7:196:9 | m15 | |
981982
| map.cpp:194:2:194:4 | ref arg m15 | map.cpp:211:2:211:4 | m15 | |
982983
| map.cpp:194:2:194:4 | ref arg m15 | map.cpp:249:1:249:1 | m15 | |
984+
| map.cpp:194:11:194:13 | m16 | map.cpp:194:2:194:4 | ref arg m15 | TAINT |
983985
| map.cpp:194:11:194:13 | ref arg m16 | map.cpp:197:7:197:9 | m16 | |
984986
| map.cpp:194:11:194:13 | ref arg m16 | map.cpp:211:12:211:14 | m16 | |
985987
| map.cpp:194:11:194:13 | ref arg m16 | map.cpp:249:1:249:1 | m16 | |
988+
| map.cpp:195:2:195:4 | m17 | map.cpp:195:11:195:13 | ref arg m18 | TAINT |
986989
| map.cpp:195:2:195:4 | ref arg m17 | map.cpp:198:7:198:9 | m17 | |
987990
| map.cpp:195:2:195:4 | ref arg m17 | map.cpp:212:2:212:4 | m17 | |
988991
| map.cpp:195:2:195:4 | ref arg m17 | map.cpp:249:1:249:1 | m17 | |
992+
| map.cpp:195:11:195:13 | m18 | map.cpp:195:2:195:4 | ref arg m17 | TAINT |
989993
| map.cpp:195:11:195:13 | ref arg m18 | map.cpp:199:7:199:9 | m18 | |
990994
| map.cpp:195:11:195:13 | ref arg m18 | map.cpp:212:12:212:14 | m18 | |
991995
| map.cpp:195:11:195:13 | ref arg m18 | map.cpp:249:1:249:1 | m18 | |
@@ -1573,15 +1577,19 @@
15731577
| map.cpp:340:7:340:9 | m16 | map.cpp:340:7:340:9 | call to unordered_map | |
15741578
| map.cpp:341:7:341:9 | m17 | map.cpp:341:7:341:9 | call to unordered_map | |
15751579
| map.cpp:342:7:342:9 | m18 | map.cpp:342:7:342:9 | call to unordered_map | |
1580+
| map.cpp:343:2:343:4 | m15 | map.cpp:343:11:343:13 | ref arg m16 | TAINT |
15761581
| map.cpp:343:2:343:4 | ref arg m15 | map.cpp:345:7:345:9 | m15 | |
15771582
| map.cpp:343:2:343:4 | ref arg m15 | map.cpp:360:2:360:4 | m15 | |
15781583
| map.cpp:343:2:343:4 | ref arg m15 | map.cpp:398:1:398:1 | m15 | |
1584+
| map.cpp:343:11:343:13 | m16 | map.cpp:343:2:343:4 | ref arg m15 | TAINT |
15791585
| map.cpp:343:11:343:13 | ref arg m16 | map.cpp:346:7:346:9 | m16 | |
15801586
| map.cpp:343:11:343:13 | ref arg m16 | map.cpp:360:12:360:14 | m16 | |
15811587
| map.cpp:343:11:343:13 | ref arg m16 | map.cpp:398:1:398:1 | m16 | |
1588+
| map.cpp:344:2:344:4 | m17 | map.cpp:344:11:344:13 | ref arg m18 | TAINT |
15821589
| map.cpp:344:2:344:4 | ref arg m17 | map.cpp:347:7:347:9 | m17 | |
15831590
| map.cpp:344:2:344:4 | ref arg m17 | map.cpp:361:2:361:4 | m17 | |
15841591
| map.cpp:344:2:344:4 | ref arg m17 | map.cpp:398:1:398:1 | m17 | |
1592+
| map.cpp:344:11:344:13 | m18 | map.cpp:344:2:344:4 | ref arg m17 | TAINT |
15851593
| map.cpp:344:11:344:13 | ref arg m18 | map.cpp:348:7:348:9 | m18 | |
15861594
| map.cpp:344:11:344:13 | ref arg m18 | map.cpp:361:12:361:14 | m18 | |
15871595
| map.cpp:344:11:344:13 | ref arg m18 | map.cpp:398:1:398:1 | m18 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -194,8 +194,8 @@ void test_map()
194194
m15.swap(m16);
195195
m17.swap(m18);
196196
sink(m15); // [FALSE POSITIVE]
197-
sink(m16); // tainted [NOT DETECTED]
198-
sink(m17); // tainted [NOT DETECTED]
197+
sink(m16); // tainted
198+
sink(m17); // tainted
199199
sink(m18); // [FALSE POSITIVE]
200200

201201
// merge
@@ -343,8 +343,8 @@ void test_unordered_map()
343343
m15.swap(m16);
344344
m17.swap(m18);
345345
sink(m15); // [FALSE POSITIVE]
346-
sink(m16); // tainted [NOT DETECTED]
347-
sink(m17); // tainted [NOT DETECTED]
346+
sink(m16); // tainted
347+
sink(m17); // tainted
348348
sink(m18); // [FALSE POSITIVE]
349349

350350
// merge

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,10 @@
6363
| map.cpp:193:7:193:9 | call to map | map.cpp:189:49:189:54 | call to source |
6464
| map.cpp:196:7:196:9 | call to map | map.cpp:188:39:188:44 | call to source |
6565
| map.cpp:196:7:196:9 | call to map | map.cpp:188:49:188:54 | call to source |
66+
| map.cpp:197:7:197:9 | call to map | map.cpp:188:39:188:44 | call to source |
67+
| map.cpp:197:7:197:9 | call to map | map.cpp:188:49:188:54 | call to source |
68+
| map.cpp:198:7:198:9 | call to map | map.cpp:189:39:189:44 | call to source |
69+
| map.cpp:198:7:198:9 | call to map | map.cpp:189:49:189:54 | call to source |
6670
| map.cpp:199:7:199:9 | call to map | map.cpp:189:39:189:44 | call to source |
6771
| map.cpp:199:7:199:9 | call to map | map.cpp:189:49:189:54 | call to source |
6872
| map.cpp:207:7:207:9 | call to map | map.cpp:203:39:203:44 | call to source |
@@ -102,6 +106,10 @@
102106
| map.cpp:342:7:342:9 | call to unordered_map | map.cpp:338:49:338:54 | call to source |
103107
| map.cpp:345:7:345:9 | call to unordered_map | map.cpp:337:39:337:44 | call to source |
104108
| map.cpp:345:7:345:9 | call to unordered_map | map.cpp:337:49:337:54 | call to source |
109+
| map.cpp:346:7:346:9 | call to unordered_map | map.cpp:337:39:337:44 | call to source |
110+
| map.cpp:346:7:346:9 | call to unordered_map | map.cpp:337:49:337:54 | call to source |
111+
| map.cpp:347:7:347:9 | call to unordered_map | map.cpp:338:39:338:44 | call to source |
112+
| map.cpp:347:7:347:9 | call to unordered_map | map.cpp:338:49:338:54 | call to source |
105113
| map.cpp:348:7:348:9 | call to unordered_map | map.cpp:338:39:338:44 | call to source |
106114
| map.cpp:348:7:348:9 | call to unordered_map | map.cpp:338:49:338:54 | call to source |
107115
| map.cpp:356:7:356:9 | call to unordered_map | map.cpp:352:39:352:44 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,10 @@
6060
| map.cpp:193:7:193:9 | map.cpp:189:49:189:54 | AST only |
6161
| map.cpp:196:7:196:9 | map.cpp:188:39:188:44 | AST only |
6262
| map.cpp:196:7:196:9 | map.cpp:188:49:188:54 | AST only |
63+
| map.cpp:197:7:197:9 | map.cpp:188:39:188:44 | AST only |
64+
| map.cpp:197:7:197:9 | map.cpp:188:49:188:54 | AST only |
65+
| map.cpp:198:7:198:9 | map.cpp:189:39:189:44 | AST only |
66+
| map.cpp:198:7:198:9 | map.cpp:189:49:189:54 | AST only |
6367
| map.cpp:199:7:199:9 | map.cpp:189:39:189:44 | AST only |
6468
| map.cpp:199:7:199:9 | map.cpp:189:49:189:54 | AST only |
6569
| map.cpp:207:7:207:9 | map.cpp:203:39:203:44 | AST only |
@@ -100,6 +104,10 @@
100104
| map.cpp:342:7:342:9 | map.cpp:338:49:338:54 | AST only |
101105
| map.cpp:345:7:345:9 | map.cpp:337:39:337:44 | AST only |
102106
| map.cpp:345:7:345:9 | map.cpp:337:49:337:54 | AST only |
107+
| map.cpp:346:7:346:9 | map.cpp:337:39:337:44 | AST only |
108+
| map.cpp:346:7:346:9 | map.cpp:337:49:337:54 | AST only |
109+
| map.cpp:347:7:347:9 | map.cpp:338:39:338:44 | AST only |
110+
| map.cpp:347:7:347:9 | map.cpp:338:49:338:54 | AST only |
103111
| map.cpp:348:7:348:9 | map.cpp:338:39:338:44 | AST only |
104112
| map.cpp:348:7:348:9 | map.cpp:338:49:338:54 | AST only |
105113
| map.cpp:356:7:356:9 | map.cpp:352:39:352:44 | AST only |

0 commit comments

Comments
 (0)