Skip to content

Commit 1b3d69d

Browse files
jbjjbj
authored
Merge pull request #4784 from MathiasVP/mathiasvp/reverse-read-take-3
C++: Support longer access paths in IR field flow
2 parents 527c415 + b4f9b15 commit 1b3d69d

File tree

17 files changed

+1488
-881
lines changed

17 files changed

+1488
-881
lines changed

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 184 additions & 150 deletions
Large diffs are not rendered by default.

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 281 additions & 110 deletions
Large diffs are not rendered by default.

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected‎

Lines changed: 13 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -26,60 +26,21 @@ unreachableNodeCCtx
2626
localCallNodes
2727
postIsNotPre
2828
postHasUniquePre
29+
| dispatch.cpp:15:8:15:8 | Top output argument | PostUpdateNode should have one pre-update node but has 0. |
30+
| dispatch.cpp:21:8:21:8 | Middle output argument | PostUpdateNode should have one pre-update node but has 0. |
31+
| dispatch.cpp:60:18:60:29 | Bottom output argument | PostUpdateNode should have one pre-update node but has 0. |
32+
| dispatch.cpp:61:18:61:29 | Middle output argument | PostUpdateNode should have one pre-update node but has 0. |
33+
| dispatch.cpp:65:10:65:21 | Bottom output argument | PostUpdateNode should have one pre-update node but has 0. |
34+
| test.cpp:384:10:384:13 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
35+
| test.cpp:391:10:391:13 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
36+
| test.cpp:400:10:400:13 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
37+
| test.cpp:407:10:407:13 | memcpy output argument | PostUpdateNode should have one pre-update node but has 0. |
2938
uniquePostUpdate
3039
postIsInSameCallable
3140
reverseRead
3241
argHasPostUpdate
3342
postWithInFlow
34-
| BarrierGuard.cpp:49:3:49:17 | Chi | PostUpdateNode should not be the target of local flow. |
35-
| BarrierGuard.cpp:60:3:60:18 | Chi | PostUpdateNode should not be the target of local flow. |
36-
| clang.cpp:28:3:28:34 | Chi | PostUpdateNode should not be the target of local flow. |
37-
| clang.cpp:34:22:34:27 | Chi | PostUpdateNode should not be the target of local flow. |
38-
| clang.cpp:34:32:34:37 | Chi | PostUpdateNode should not be the target of local flow. |
39-
| clang.cpp:39:32:39:37 | Chi | PostUpdateNode should not be the target of local flow. |
40-
| clang.cpp:39:42:39:47 | Chi | PostUpdateNode should not be the target of local flow. |
41-
| clang.cpp:43:35:43:40 | Chi | PostUpdateNode should not be the target of local flow. |
42-
| clang.cpp:43:51:43:51 | Chi | PostUpdateNode should not be the target of local flow. |
43-
| clang.cpp:49:25:49:30 | Chi | PostUpdateNode should not be the target of local flow. |
44-
| clang.cpp:49:35:49:40 | Chi | PostUpdateNode should not be the target of local flow. |
45-
| clang.cpp:50:3:50:26 | Chi | PostUpdateNode should not be the target of local flow. |
46-
| example.c:17:19:17:22 | Chi | PostUpdateNode should not be the target of local flow. |
47-
| example.c:17:21:17:21 | Chi | PostUpdateNode should not be the target of local flow. |
48-
| example.c:24:2:24:30 | Chi | PostUpdateNode should not be the target of local flow. |
49-
| example.c:24:13:24:30 | Chi | PostUpdateNode should not be the target of local flow. |
50-
| example.c:26:2:26:25 | Chi | PostUpdateNode should not be the target of local flow. |
51-
| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
52-
| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
53-
| file://:0:0:0:0 | Chi | PostUpdateNode should not be the target of local flow. |
54-
| lambdas.cpp:13:12:13:12 | Chi | PostUpdateNode should not be the target of local flow. |
55-
| lambdas.cpp:13:15:13:15 | Chi | PostUpdateNode should not be the target of local flow. |
56-
| lambdas.cpp:28:10:31:2 | Chi | PostUpdateNode should not be the target of local flow. |
57-
| lambdas.cpp:28:10:31:2 | Chi | PostUpdateNode should not be the target of local flow. |
58-
| lambdas.cpp:43:3:43:14 | Chi | PostUpdateNode should not be the target of local flow. |
59-
| ref.cpp:11:5:11:13 | Chi | PostUpdateNode should not be the target of local flow. |
60-
| ref.cpp:20:5:20:13 | Chi | PostUpdateNode should not be the target of local flow. |
61-
| ref.cpp:22:7:22:13 | Chi | PostUpdateNode should not be the target of local flow. |
62-
| ref.cpp:24:7:24:13 | Chi | PostUpdateNode should not be the target of local flow. |
63-
| ref.cpp:29:5:29:18 | Chi | PostUpdateNode should not be the target of local flow. |
64-
| ref.cpp:31:7:31:13 | Chi | PostUpdateNode should not be the target of local flow. |
65-
| ref.cpp:39:7:39:13 | Chi | PostUpdateNode should not be the target of local flow. |
66-
| ref.cpp:44:5:44:18 | Chi | PostUpdateNode should not be the target of local flow. |
67-
| ref.cpp:46:7:46:13 | Chi | PostUpdateNode should not be the target of local flow. |
68-
| ref.cpp:48:7:48:13 | Chi | PostUpdateNode should not be the target of local flow. |
69-
| ref.cpp:75:5:75:17 | Chi | PostUpdateNode should not be the target of local flow. |
70-
| ref.cpp:83:5:83:17 | Chi | PostUpdateNode should not be the target of local flow. |
71-
| ref.cpp:87:7:87:17 | Chi | PostUpdateNode should not be the target of local flow. |
72-
| ref.cpp:89:7:89:17 | Chi | PostUpdateNode should not be the target of local flow. |
73-
| ref.cpp:94:5:94:22 | Chi | PostUpdateNode should not be the target of local flow. |
74-
| ref.cpp:96:7:96:17 | Chi | PostUpdateNode should not be the target of local flow. |
75-
| ref.cpp:104:7:104:17 | Chi | PostUpdateNode should not be the target of local flow. |
76-
| ref.cpp:109:5:109:22 | Chi | PostUpdateNode should not be the target of local flow. |
77-
| ref.cpp:113:7:113:17 | Chi | PostUpdateNode should not be the target of local flow. |
78-
| ref.cpp:115:7:115:17 | Chi | PostUpdateNode should not be the target of local flow. |
79-
| test.cpp:91:3:91:18 | Chi | PostUpdateNode should not be the target of local flow. |
80-
| test.cpp:115:3:115:17 | Chi | PostUpdateNode should not be the target of local flow. |
81-
| test.cpp:120:3:120:10 | Chi | PostUpdateNode should not be the target of local flow. |
82-
| test.cpp:125:3:125:11 | Chi | PostUpdateNode should not be the target of local flow. |
83-
| test.cpp:359:5:359:20 | Chi | PostUpdateNode should not be the target of local flow. |
84-
| test.cpp:373:5:373:20 | Chi | PostUpdateNode should not be the target of local flow. |
85-
| test.cpp:465:3:465:15 | Chi | PostUpdateNode should not be the target of local flow. |
43+
| test.cpp:384:10:384:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
44+
| test.cpp:391:10:391:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
45+
| test.cpp:400:10:400:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |
46+
| test.cpp:407:10:407:13 | memcpy output argument | PostUpdateNode should not be the target of local flow. |

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/test.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -362,7 +362,7 @@ class FlowThroughFields {
362362
int f() {
363363
sink(field); // tainted or clean? Not sure.
364364
taintField();
365-
sink(field); // $ ast MISSING: ir
365+
sink(field); // $ ast,ir
366366
}
367367

368368
int calledAfterTaint() {

‎cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,4 +204,32 @@ void deep_member_field_arrow(S2 *ps2) {
204204
void deep_member_field_arrow_different_fields(S2 *ps2) {
205205
taint_a_ptr(&ps2->s.m1);
206206
sink(ps2->s.m2);
207+
}
208+
209+
void test_deep_struct_fields() {
210+
S2 s2;
211+
s2.s.m1 = user_input();
212+
S s = s2.s;
213+
sink(s.m1); // $ ast,ir
214+
}
215+
216+
void test_deep_struct_fields_no_flow() {
217+
S2 s2;
218+
s2.s.m1 = user_input();
219+
S s = s2.s;
220+
sink(s.m2);
221+
}
222+
223+
void test_deep_struct_fields_taint_through_call() {
224+
S2 s2;
225+
taint_a_ptr(&s2.s.m1);
226+
S s = s2.s;
227+
sink(s.m1); // $ ast,ir
228+
}
229+
230+
void test_deep_struct_fields_taint_through_call_no_flow() {
231+
S2 s2;
232+
taint_a_ptr(&s2.s.m1);
233+
S s = s2.s;
234+
sink(s.m2);
207235
}

‎cpp/ql/test/library-tests/dataflow/fields/by_reference.cpp‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
void sink(void *o);
1+
void sink(void *o); void sink(const char *o);
22
void *user_input(void);
33

44
struct S {
@@ -135,3 +135,13 @@ void test_outer_with_ref(Outer *pouter) {
135135
sink(pouter->inner_ptr->a); // $ ast MISSING: ir
136136
sink(pouter->a); // $ ast,ir
137137
}
138+
139+
void taint_a_ptr(const char **pa) {
140+
*pa = (char*)user_input();
141+
}
142+
143+
void test_const_char_ref() {
144+
const char* s;
145+
taint_a_ptr(&s);
146+
sink(s); // $ ast ir=140:9 ir=140:16
147+
}

‎cpp/ql/test/library-tests/dataflow/fields/dataflow-consistency.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,10 @@ postWithInFlow
8989
| aliasing.cpp:194:21:194:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
9090
| aliasing.cpp:200:23:200:24 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
9191
| aliasing.cpp:205:23:205:24 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
92+
| aliasing.cpp:211:8:211:9 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
93+
| aliasing.cpp:218:8:218:9 | m1 [post update] | PostUpdateNode should not be the target of local flow. |
94+
| aliasing.cpp:225:21:225:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
95+
| aliasing.cpp:232:21:232:22 | m1 [inner post update] | PostUpdateNode should not be the target of local flow. |
9296
| arrays.cpp:6:3:6:5 | arr [inner post update] | PostUpdateNode should not be the target of local flow. |
9397
| arrays.cpp:6:3:6:8 | access to array [post update] | PostUpdateNode should not be the target of local flow. |
9498
| arrays.cpp:15:3:15:10 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
@@ -119,6 +123,9 @@ postWithInFlow
119123
| by_reference.cpp:108:24:108:24 | a [inner post update] | PostUpdateNode should not be the target of local flow. |
120124
| by_reference.cpp:123:28:123:36 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
121125
| by_reference.cpp:127:30:127:38 | inner_ptr [inner post update] | PostUpdateNode should not be the target of local flow. |
126+
| by_reference.cpp:140:3:140:5 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
127+
| by_reference.cpp:140:4:140:5 | pa [inner post update] | PostUpdateNode should not be the target of local flow. |
128+
| by_reference.cpp:145:16:145:16 | s [inner post update] | PostUpdateNode should not be the target of local flow. |
122129
| complex.cpp:11:22:11:23 | a_ [post update] | PostUpdateNode should not be the target of local flow. |
123130
| complex.cpp:12:22:12:23 | b_ [post update] | PostUpdateNode should not be the target of local flow. |
124131
| conflated.cpp:10:3:10:7 | * ... [post update] | PostUpdateNode should not be the target of local flow. |
@@ -152,5 +159,6 @@ postWithInFlow
152159
| simple.cpp:65:7:65:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
153160
| simple.cpp:83:12:83:13 | f1 [post update] | PostUpdateNode should not be the target of local flow. |
154161
| simple.cpp:92:7:92:7 | i [post update] | PostUpdateNode should not be the target of local flow. |
162+
| simple.cpp:104:9:104:9 | i [post update] | PostUpdateNode should not be the target of local flow. |
155163
| struct_init.c:24:11:24:12 | ab [inner post update] | PostUpdateNode should not be the target of local flow. |
156164
| struct_init.c:36:17:36:24 | nestedAB [inner post update] | PostUpdateNode should not be the target of local flow. |

0 commit comments

Comments
 (0)