Skip to content

Commit 2235c19

Browse files
geoffw0geoffw0
committed
C++: Add test cases for 'assign' and extra cases for 'data'.
1 parent b1946c6 commit 2235c19

File tree

6 files changed

+194
-3
lines changed

6 files changed

+194
-3
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -717,6 +717,19 @@
717717
| string.cpp:337:9:337:9 | a | string.cpp:337:10:337:10 | call to operator[] | TAINT |
718718
| string.cpp:337:9:337:9 | ref arg a | string.cpp:339:7:339:7 | a | |
719719
| string.cpp:337:10:337:10 | call to operator[] | string.cpp:337:2:337:12 | ... = ... | |
720+
| string.cpp:346:18:346:22 | 123 | string.cpp:346:18:346:23 | call to basic_string | TAINT |
721+
| string.cpp:346:18:346:23 | call to basic_string | string.cpp:348:2:348:4 | str | |
722+
| string.cpp:346:18:346:23 | call to basic_string | string.cpp:349:7:349:9 | str | |
723+
| string.cpp:346:18:346:23 | call to basic_string | string.cpp:350:7:350:9 | str | |
724+
| string.cpp:348:2:348:4 | ref arg str | string.cpp:349:7:349:9 | str | |
725+
| string.cpp:348:2:348:4 | ref arg str | string.cpp:350:7:350:9 | str | |
726+
| string.cpp:348:2:348:4 | str | string.cpp:348:6:348:9 | call to data | TAINT |
727+
| string.cpp:348:2:348:14 | access to array [post update] | string.cpp:348:6:348:9 | call to data [inner post update] | |
728+
| string.cpp:348:2:348:34 | ... = ... | string.cpp:348:2:348:14 | access to array [post update] | |
729+
| string.cpp:348:6:348:9 | call to data | string.cpp:348:2:348:14 | access to array | TAINT |
730+
| string.cpp:348:13:348:13 | 1 | string.cpp:348:2:348:14 | access to array | TAINT |
731+
| string.cpp:348:18:348:32 | call to source | string.cpp:348:2:348:34 | ... = ... | |
732+
| string.cpp:350:7:350:9 | str | string.cpp:350:11:350:14 | call to data | TAINT |
720733
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:16:2:16:4 | ss1 | |
721734
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:22:7:22:9 | ss1 | |
722735
| stringstream.cpp:13:20:13:22 | call to basic_stringstream | stringstream.cpp:27:7:27:9 | ss1 | |
@@ -2209,3 +2222,117 @@
22092222
| vector.cpp:212:8:212:9 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
22102223
| vector.cpp:212:10:212:10 | call to operator[] [post update] | vector.cpp:212:8:212:9 | ref arg ff | TAINT |
22112224
| vector.cpp:212:14:212:15 | vs | vector.cpp:212:16:212:16 | call to operator[] | TAINT |
2225+
| vector.cpp:219:19:219:20 | call to vector | vector.cpp:221:2:221:3 | v1 | |
2226+
| vector.cpp:219:19:219:20 | call to vector | vector.cpp:225:7:225:8 | v1 | |
2227+
| vector.cpp:219:19:219:20 | call to vector | vector.cpp:233:13:233:14 | v1 | |
2228+
| vector.cpp:219:19:219:20 | call to vector | vector.cpp:233:25:233:26 | v1 | |
2229+
| vector.cpp:219:19:219:20 | call to vector | vector.cpp:247:1:247:1 | v1 | |
2230+
| vector.cpp:219:23:219:24 | call to vector | vector.cpp:222:2:222:3 | v2 | |
2231+
| vector.cpp:219:23:219:24 | call to vector | vector.cpp:226:7:226:8 | v2 | |
2232+
| vector.cpp:219:23:219:24 | call to vector | vector.cpp:247:1:247:1 | v2 | |
2233+
| vector.cpp:219:27:219:28 | call to vector | vector.cpp:223:2:223:3 | v3 | |
2234+
| vector.cpp:219:27:219:28 | call to vector | vector.cpp:227:7:227:8 | v3 | |
2235+
| vector.cpp:219:27:219:28 | call to vector | vector.cpp:234:13:234:14 | v3 | |
2236+
| vector.cpp:219:27:219:28 | call to vector | vector.cpp:234:25:234:26 | v3 | |
2237+
| vector.cpp:219:27:219:28 | call to vector | vector.cpp:235:8:235:9 | v3 | |
2238+
| vector.cpp:219:27:219:28 | call to vector | vector.cpp:247:1:247:1 | v3 | |
2239+
| vector.cpp:221:2:221:3 | ref arg v1 | vector.cpp:225:7:225:8 | v1 | |
2240+
| vector.cpp:221:2:221:3 | ref arg v1 | vector.cpp:233:13:233:14 | v1 | |
2241+
| vector.cpp:221:2:221:3 | ref arg v1 | vector.cpp:233:25:233:26 | v1 | |
2242+
| vector.cpp:221:2:221:3 | ref arg v1 | vector.cpp:247:1:247:1 | v1 | |
2243+
| vector.cpp:222:2:222:3 | ref arg v2 | vector.cpp:226:7:226:8 | v2 | |
2244+
| vector.cpp:222:2:222:3 | ref arg v2 | vector.cpp:247:1:247:1 | v2 | |
2245+
| vector.cpp:223:2:223:3 | ref arg v3 | vector.cpp:227:7:227:8 | v3 | |
2246+
| vector.cpp:223:2:223:3 | ref arg v3 | vector.cpp:234:13:234:14 | v3 | |
2247+
| vector.cpp:223:2:223:3 | ref arg v3 | vector.cpp:234:25:234:26 | v3 | |
2248+
| vector.cpp:223:2:223:3 | ref arg v3 | vector.cpp:235:8:235:9 | v3 | |
2249+
| vector.cpp:223:2:223:3 | ref arg v3 | vector.cpp:247:1:247:1 | v3 | |
2250+
| vector.cpp:223:15:223:20 | call to source | vector.cpp:223:2:223:3 | ref arg v3 | TAINT |
2251+
| vector.cpp:225:7:225:8 | ref arg v1 | vector.cpp:233:13:233:14 | v1 | |
2252+
| vector.cpp:225:7:225:8 | ref arg v1 | vector.cpp:233:25:233:26 | v1 | |
2253+
| vector.cpp:225:7:225:8 | ref arg v1 | vector.cpp:247:1:247:1 | v1 | |
2254+
| vector.cpp:226:7:226:8 | ref arg v2 | vector.cpp:247:1:247:1 | v2 | |
2255+
| vector.cpp:227:7:227:8 | ref arg v3 | vector.cpp:234:13:234:14 | v3 | |
2256+
| vector.cpp:227:7:227:8 | ref arg v3 | vector.cpp:234:25:234:26 | v3 | |
2257+
| vector.cpp:227:7:227:8 | ref arg v3 | vector.cpp:235:8:235:9 | v3 | |
2258+
| vector.cpp:227:7:227:8 | ref arg v3 | vector.cpp:247:1:247:1 | v3 | |
2259+
| vector.cpp:230:20:230:21 | call to vector | vector.cpp:233:3:233:4 | v4 | |
2260+
| vector.cpp:230:20:230:21 | call to vector | vector.cpp:241:8:241:9 | v4 | |
2261+
| vector.cpp:230:20:230:21 | call to vector | vector.cpp:246:2:246:2 | v4 | |
2262+
| vector.cpp:230:24:230:25 | call to vector | vector.cpp:234:3:234:4 | v5 | |
2263+
| vector.cpp:230:24:230:25 | call to vector | vector.cpp:242:8:242:9 | v5 | |
2264+
| vector.cpp:230:24:230:25 | call to vector | vector.cpp:246:2:246:2 | v5 | |
2265+
| vector.cpp:230:28:230:29 | call to vector | vector.cpp:239:3:239:4 | v6 | |
2266+
| vector.cpp:230:28:230:29 | call to vector | vector.cpp:245:8:245:9 | v6 | |
2267+
| vector.cpp:230:28:230:29 | call to vector | vector.cpp:246:2:246:2 | v6 | |
2268+
| vector.cpp:233:3:233:4 | ref arg v4 | vector.cpp:241:8:241:9 | v4 | |
2269+
| vector.cpp:233:3:233:4 | ref arg v4 | vector.cpp:246:2:246:2 | v4 | |
2270+
| vector.cpp:233:13:233:14 | ref arg v1 | vector.cpp:233:25:233:26 | v1 | |
2271+
| vector.cpp:233:13:233:14 | ref arg v1 | vector.cpp:247:1:247:1 | v1 | |
2272+
| vector.cpp:233:25:233:26 | ref arg v1 | vector.cpp:247:1:247:1 | v1 | |
2273+
| vector.cpp:234:3:234:4 | ref arg v5 | vector.cpp:242:8:242:9 | v5 | |
2274+
| vector.cpp:234:3:234:4 | ref arg v5 | vector.cpp:246:2:246:2 | v5 | |
2275+
| vector.cpp:234:13:234:14 | ref arg v3 | vector.cpp:234:25:234:26 | v3 | |
2276+
| vector.cpp:234:13:234:14 | ref arg v3 | vector.cpp:235:8:235:9 | v3 | |
2277+
| vector.cpp:234:13:234:14 | ref arg v3 | vector.cpp:247:1:247:1 | v3 | |
2278+
| vector.cpp:234:25:234:26 | ref arg v3 | vector.cpp:235:8:235:9 | v3 | |
2279+
| vector.cpp:234:25:234:26 | ref arg v3 | vector.cpp:247:1:247:1 | v3 | |
2280+
| vector.cpp:235:8:235:9 | ref arg v3 | vector.cpp:247:1:247:1 | v3 | |
2281+
| vector.cpp:235:11:235:15 | call to begin | vector.cpp:235:3:235:17 | ... = ... | |
2282+
| vector.cpp:235:11:235:15 | call to begin | vector.cpp:236:3:236:4 | i1 | |
2283+
| vector.cpp:235:11:235:15 | call to begin | vector.cpp:237:8:237:9 | i1 | |
2284+
| vector.cpp:235:11:235:15 | call to begin | vector.cpp:239:13:239:14 | i1 | |
2285+
| vector.cpp:235:11:235:15 | call to begin | vector.cpp:243:8:243:9 | i1 | |
2286+
| vector.cpp:236:3:236:4 | ref arg i1 | vector.cpp:237:8:237:9 | i1 | |
2287+
| vector.cpp:236:3:236:4 | ref arg i1 | vector.cpp:239:13:239:14 | i1 | |
2288+
| vector.cpp:236:3:236:4 | ref arg i1 | vector.cpp:243:8:243:9 | i1 | |
2289+
| vector.cpp:237:8:237:9 | i1 | vector.cpp:237:3:237:9 | ... = ... | |
2290+
| vector.cpp:237:8:237:9 | i1 | vector.cpp:238:3:238:4 | i2 | |
2291+
| vector.cpp:237:8:237:9 | i1 | vector.cpp:239:17:239:18 | i2 | |
2292+
| vector.cpp:237:8:237:9 | i1 | vector.cpp:244:8:244:9 | i2 | |
2293+
| vector.cpp:238:3:238:4 | ref arg i2 | vector.cpp:239:17:239:18 | i2 | |
2294+
| vector.cpp:238:3:238:4 | ref arg i2 | vector.cpp:244:8:244:9 | i2 | |
2295+
| vector.cpp:239:3:239:4 | ref arg v6 | vector.cpp:245:8:245:9 | v6 | |
2296+
| vector.cpp:239:3:239:4 | ref arg v6 | vector.cpp:246:2:246:2 | v6 | |
2297+
| vector.cpp:241:8:241:9 | ref arg v4 | vector.cpp:246:2:246:2 | v4 | |
2298+
| vector.cpp:242:8:242:9 | ref arg v5 | vector.cpp:246:2:246:2 | v5 | |
2299+
| vector.cpp:245:8:245:9 | ref arg v6 | vector.cpp:246:2:246:2 | v6 | |
2300+
| vector.cpp:252:19:252:20 | call to vector | vector.cpp:254:2:254:3 | v1 | |
2301+
| vector.cpp:252:19:252:20 | call to vector | vector.cpp:255:7:255:8 | v1 | |
2302+
| vector.cpp:252:19:252:20 | call to vector | vector.cpp:256:7:256:8 | v1 | |
2303+
| vector.cpp:252:19:252:20 | call to vector | vector.cpp:257:7:257:8 | v1 | |
2304+
| vector.cpp:252:19:252:20 | call to vector | vector.cpp:263:1:263:1 | v1 | |
2305+
| vector.cpp:252:23:252:24 | call to vector | vector.cpp:259:4:259:5 | v2 | |
2306+
| vector.cpp:252:23:252:24 | call to vector | vector.cpp:260:7:260:8 | v2 | |
2307+
| vector.cpp:252:23:252:24 | call to vector | vector.cpp:261:7:261:8 | v2 | |
2308+
| vector.cpp:252:23:252:24 | call to vector | vector.cpp:262:7:262:8 | v2 | |
2309+
| vector.cpp:252:23:252:24 | call to vector | vector.cpp:263:1:263:1 | v2 | |
2310+
| vector.cpp:254:2:254:3 | ref arg v1 | vector.cpp:255:7:255:8 | v1 | |
2311+
| vector.cpp:254:2:254:3 | ref arg v1 | vector.cpp:256:7:256:8 | v1 | |
2312+
| vector.cpp:254:2:254:3 | ref arg v1 | vector.cpp:257:7:257:8 | v1 | |
2313+
| vector.cpp:254:2:254:3 | ref arg v1 | vector.cpp:263:1:263:1 | v1 | |
2314+
| vector.cpp:254:15:254:20 | call to source | vector.cpp:254:2:254:3 | ref arg v1 | TAINT |
2315+
| vector.cpp:255:7:255:8 | ref arg v1 | vector.cpp:256:7:256:8 | v1 | |
2316+
| vector.cpp:255:7:255:8 | ref arg v1 | vector.cpp:257:7:257:8 | v1 | |
2317+
| vector.cpp:255:7:255:8 | ref arg v1 | vector.cpp:263:1:263:1 | v1 | |
2318+
| vector.cpp:256:7:256:8 | ref arg v1 | vector.cpp:257:7:257:8 | v1 | |
2319+
| vector.cpp:256:7:256:8 | ref arg v1 | vector.cpp:263:1:263:1 | v1 | |
2320+
| vector.cpp:257:7:257:8 | ref arg v1 | vector.cpp:263:1:263:1 | v1 | |
2321+
| vector.cpp:257:10:257:13 | call to data | vector.cpp:257:7:257:18 | access to array | TAINT |
2322+
| vector.cpp:257:17:257:17 | 2 | vector.cpp:257:7:257:18 | access to array | TAINT |
2323+
| vector.cpp:259:2:259:13 | * ... [post update] | vector.cpp:259:7:259:10 | call to data [inner post update] | |
2324+
| vector.cpp:259:2:259:32 | ... = ... | vector.cpp:259:2:259:13 | * ... [post update] | |
2325+
| vector.cpp:259:4:259:5 | ref arg v2 | vector.cpp:260:7:260:8 | v2 | |
2326+
| vector.cpp:259:4:259:5 | ref arg v2 | vector.cpp:261:7:261:8 | v2 | |
2327+
| vector.cpp:259:4:259:5 | ref arg v2 | vector.cpp:262:7:262:8 | v2 | |
2328+
| vector.cpp:259:4:259:5 | ref arg v2 | vector.cpp:263:1:263:1 | v2 | |
2329+
| vector.cpp:259:7:259:10 | call to data | vector.cpp:259:2:259:13 | * ... | TAINT |
2330+
| vector.cpp:259:17:259:30 | call to source | vector.cpp:259:2:259:32 | ... = ... | |
2331+
| vector.cpp:260:7:260:8 | ref arg v2 | vector.cpp:261:7:261:8 | v2 | |
2332+
| vector.cpp:260:7:260:8 | ref arg v2 | vector.cpp:262:7:262:8 | v2 | |
2333+
| vector.cpp:260:7:260:8 | ref arg v2 | vector.cpp:263:1:263:1 | v2 | |
2334+
| vector.cpp:261:7:261:8 | ref arg v2 | vector.cpp:262:7:262:8 | v2 | |
2335+
| vector.cpp:261:7:261:8 | ref arg v2 | vector.cpp:263:1:263:1 | v2 | |
2336+
| vector.cpp:262:7:262:8 | ref arg v2 | vector.cpp:263:1:263:1 | v2 | |
2337+
| vector.cpp:262:10:262:13 | call to data | vector.cpp:262:7:262:18 | access to array | TAINT |
2338+
| vector.cpp:262:17:262:17 | 2 | vector.cpp:262:7:262:18 | access to array | TAINT |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@ namespace std {
142142

143143
vector& operator=(const vector& x);
144144
vector& operator=(vector&& x) noexcept/*(allocator_traits<Allocator>::propagate_on_container_move_assignment::value || allocator_traits<Allocator>::is_always_equal::value)*/;
145+
template<class InputIterator> void assign(InputIterator first, InputIterator last);
146+
void assign(size_type n, const T& u);
145147

146148
iterator begin() noexcept;
147149
const_iterator begin() const noexcept;

‎cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -340,3 +340,12 @@ void test_string_at()
340340
sink(b); // tainted
341341
sink(c); // tainted
342342
}
343+
344+
void test_string_data_more()
345+
{
346+
std::string str("123");
347+
348+
str.data()[1] = ns_char::source();
349+
sink(str); // tainted [NOT DETECTED]
350+
sink(str.data()); // tainted [NOT DETECTED]
351+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -237,3 +237,5 @@
237237
| vector.cpp:171:13:171:13 | call to operator[] | vector.cpp:170:14:170:19 | call to source |
238238
| vector.cpp:180:13:180:13 | call to operator[] | vector.cpp:179:14:179:19 | call to source |
239239
| vector.cpp:201:13:201:13 | call to operator[] | vector.cpp:200:14:200:19 | call to source |
240+
| vector.cpp:227:7:227:8 | v3 | vector.cpp:223:15:223:20 | call to source |
241+
| vector.cpp:255:7:255:8 | v1 | vector.cpp:254:15:254:20 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,3 +173,5 @@
173173
| vector.cpp:171:13:171:13 | vector.cpp:170:14:170:19 | AST only |
174174
| vector.cpp:180:13:180:13 | vector.cpp:179:14:179:19 | AST only |
175175
| vector.cpp:201:13:201:13 | vector.cpp:200:14:200:19 | AST only |
176+
| vector.cpp:227:7:227:8 | vector.cpp:223:15:223:20 | AST only |
177+
| vector.cpp:255:7:255:8 | vector.cpp:254:15:254:20 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ using namespace std;
55

66
int source();
77

8-
namespace ns_char
8+
namespace ns_int
99
{
10-
char source();
10+
int source();
1111
}
1212

1313
void sink(int);
@@ -87,7 +87,7 @@ void test_element_taint(int x) {
8787
{
8888
const std::vector<int> &v8c = v8;
8989
std::vector<int>::const_iterator it = v8c.begin();
90-
v8.insert(it, 10, ns_char::source());
90+
v8.insert(it, 10, ns_int::source());
9191
}
9292
sink(v8); // tainted [NOT DETECTED]
9393
sink(v8.front()); // tainted [NOT DETECTED]
@@ -212,3 +212,52 @@ void test_nested_vectors()
212212
sink(ff[0].vs[0]); // tainted [NOT DETECTED]
213213
}
214214
}
215+
216+
void sink(std::vector<int>::iterator &);
217+
218+
void test_vector_assign() {
219+
std::vector<int> v1, v2, v3;
220+
221+
v1.assign(100, 0);
222+
v2.assign(100, ns_int::source());
223+
v3.push_back(source());
224+
225+
sink(v1);
226+
sink(v2); // tainted [NOT DETECTED]
227+
sink(v3); // tainted
228+
229+
{
230+
std::vector<int> v4, v5, v6;
231+
std::vector<int>::iterator i1, i2;
232+
233+
v4.assign(v1.begin(), v1.end());
234+
v5.assign(v3.begin(), v3.end());
235+
i1 = v3.begin();
236+
i1++;
237+
i2 = i1;
238+
i2++;
239+
v6.assign(i1, i2);
240+
241+
sink(v4);
242+
sink(v5); // tainted [NOT DETECTED]
243+
sink(i1); // tainted [NOT DETECTED]
244+
sink(i2); // tainted [NOT DETECTED]
245+
sink(v6); // tainted [NOT DETECTED]
246+
}
247+
}
248+
249+
void sink(int *);
250+
251+
void test_data_more() {
252+
std::vector<int> v1, v2;
253+
254+
v1.push_back(source());
255+
sink(v1); // tainted
256+
sink(v1.data()); // tainted [NOT DETECTED]
257+
sink(v1.data()[2]); // tainted [NOT DETECTED]
258+
259+
*(v2.data()) = ns_int::source();
260+
sink(v2); // tainted [NOT DETECTED]
261+
sink(v2.data()); // tainted [NOT DETECTED]
262+
sink(v2.data()[2]); // tainted [NOT DETECTED]
263+
}

0 commit comments

Comments
 (0)