Skip to content

Commit 23a792b

Browse files
geoffw0geoffw0
committed
C++: Add tests of nested vectors.
1 parent adbfad2 commit 23a792b

File tree

5 files changed

+262
-0
lines changed

5 files changed

+262
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,10 @@
313313
| movableclass.cpp:65:13:65:18 | call to source | movableclass.cpp:65:13:65:20 | call to MyMovableClass | TAINT |
314314
| movableclass.cpp:65:13:65:20 | call to MyMovableClass | movableclass.cpp:65:8:65:9 | ref arg s3 | TAINT |
315315
| movableclass.cpp:65:13:65:20 | call to MyMovableClass | movableclass.cpp:65:11:65:11 | call to operator= | TAINT |
316+
| stl.h:137:30:137:40 | call to allocator | stl.h:137:21:137:41 | noexcept(...) | TAINT |
317+
| stl.h:137:30:137:40 | call to allocator | stl.h:137:21:137:41 | noexcept(...) | TAINT |
318+
| stl.h:137:30:137:40 | call to allocator | stl.h:137:21:137:41 | noexcept(...) | TAINT |
319+
| stl.h:137:53:137:63 | 0 | stl.h:137:46:137:64 | (no string representation) | TAINT |
316320
| string.cpp:24:12:24:17 | call to source | string.cpp:28:7:28:7 | a | |
317321
| string.cpp:25:16:25:20 | 123 | string.cpp:25:16:25:21 | call to basic_string | TAINT |
318322
| string.cpp:25:16:25:21 | call to basic_string | string.cpp:29:7:29:7 | b | |
@@ -2026,3 +2030,182 @@
20262030
| vector.cpp:140:7:140:8 | ref arg v2 | vector.cpp:143:1:143:1 | v2 | |
20272031
| vector.cpp:141:7:141:8 | ref arg v3 | vector.cpp:143:1:143:1 | v3 | |
20282032
| vector.cpp:142:7:142:8 | ref arg v4 | vector.cpp:143:1:143:1 | v4 | |
2033+
| vector.cpp:150:8:150:8 | call to vector | vector.cpp:150:8:150:8 | constructor init of field vs | TAINT |
2034+
| vector.cpp:150:8:150:8 | call to ~vector | vector.cpp:150:8:150:8 | destructor field destruction of vs | TAINT |
2035+
| vector.cpp:150:8:150:8 | this | vector.cpp:150:8:150:8 | constructor init of field vs [pre-this] | |
2036+
| vector.cpp:158:19:158:22 | {...} | vector.cpp:160:8:160:9 | aa | |
2037+
| vector.cpp:158:19:158:22 | {...} | vector.cpp:161:3:161:4 | aa | |
2038+
| vector.cpp:158:21:158:21 | 0 | vector.cpp:158:21:158:21 | {...} | TAINT |
2039+
| vector.cpp:158:21:158:21 | {...} | vector.cpp:158:19:158:22 | {...} | TAINT |
2040+
| vector.cpp:160:8:160:9 | aa | vector.cpp:160:8:160:12 | access to array | TAINT |
2041+
| vector.cpp:160:8:160:12 | access to array | vector.cpp:160:8:160:15 | access to array | TAINT |
2042+
| vector.cpp:160:11:160:11 | 0 | vector.cpp:160:8:160:12 | access to array | TAINT |
2043+
| vector.cpp:160:14:160:14 | 0 | vector.cpp:160:8:160:15 | access to array | TAINT |
2044+
| vector.cpp:161:3:161:4 | aa | vector.cpp:161:3:161:7 | access to array | TAINT |
2045+
| vector.cpp:161:3:161:7 | access to array | vector.cpp:161:3:161:10 | access to array | TAINT |
2046+
| vector.cpp:161:6:161:6 | 0 | vector.cpp:161:3:161:7 | access to array | TAINT |
2047+
| vector.cpp:161:9:161:9 | 0 | vector.cpp:161:3:161:10 | access to array | TAINT |
2048+
| vector.cpp:161:14:161:19 | call to source | vector.cpp:161:3:161:21 | ... = ... | |
2049+
| vector.cpp:162:8:162:9 | aa | vector.cpp:162:8:162:12 | access to array | TAINT |
2050+
| vector.cpp:162:8:162:12 | access to array | vector.cpp:162:8:162:15 | access to array | TAINT |
2051+
| vector.cpp:162:11:162:11 | 0 | vector.cpp:162:8:162:12 | access to array | TAINT |
2052+
| vector.cpp:162:14:162:14 | 0 | vector.cpp:162:8:162:15 | access to array | TAINT |
2053+
| vector.cpp:166:37:166:39 | call to vector | vector.cpp:168:3:168:4 | bb | |
2054+
| vector.cpp:166:37:166:39 | call to vector | vector.cpp:169:8:169:9 | bb | |
2055+
| vector.cpp:166:37:166:39 | call to vector | vector.cpp:170:3:170:4 | bb | |
2056+
| vector.cpp:166:37:166:39 | call to vector | vector.cpp:171:8:171:9 | bb | |
2057+
| vector.cpp:166:37:166:39 | call to vector | vector.cpp:172:2:172:2 | bb | |
2058+
| vector.cpp:168:3:168:4 | bb | vector.cpp:168:5:168:5 | call to operator[] | TAINT |
2059+
| vector.cpp:168:3:168:4 | ref arg bb | vector.cpp:169:8:169:9 | bb | |
2060+
| vector.cpp:168:3:168:4 | ref arg bb | vector.cpp:170:3:170:4 | bb | |
2061+
| vector.cpp:168:3:168:4 | ref arg bb | vector.cpp:171:8:171:9 | bb | |
2062+
| vector.cpp:168:3:168:4 | ref arg bb | vector.cpp:172:2:172:2 | bb | |
2063+
| vector.cpp:168:5:168:5 | ref arg call to operator[] | vector.cpp:168:3:168:4 | ref arg bb | TAINT |
2064+
| vector.cpp:168:19:168:19 | 0 | vector.cpp:168:5:168:5 | ref arg call to operator[] | TAINT |
2065+
| vector.cpp:169:8:169:9 | bb | vector.cpp:169:10:169:10 | call to operator[] | TAINT |
2066+
| vector.cpp:169:8:169:9 | ref arg bb | vector.cpp:170:3:170:4 | bb | |
2067+
| vector.cpp:169:8:169:9 | ref arg bb | vector.cpp:171:8:171:9 | bb | |
2068+
| vector.cpp:169:8:169:9 | ref arg bb | vector.cpp:172:2:172:2 | bb | |
2069+
| vector.cpp:169:10:169:10 | call to operator[] | vector.cpp:169:13:169:13 | call to operator[] | TAINT |
2070+
| vector.cpp:169:10:169:10 | ref arg call to operator[] | vector.cpp:169:8:169:9 | ref arg bb | TAINT |
2071+
| vector.cpp:170:3:170:4 | bb | vector.cpp:170:5:170:5 | call to operator[] | TAINT |
2072+
| vector.cpp:170:3:170:4 | ref arg bb | vector.cpp:171:8:171:9 | bb | |
2073+
| vector.cpp:170:3:170:4 | ref arg bb | vector.cpp:172:2:172:2 | bb | |
2074+
| vector.cpp:170:3:170:21 | ... = ... | vector.cpp:170:8:170:8 | call to operator[] [post update] | |
2075+
| vector.cpp:170:5:170:5 | call to operator[] | vector.cpp:170:8:170:8 | call to operator[] | TAINT |
2076+
| vector.cpp:170:5:170:5 | ref arg call to operator[] | vector.cpp:170:3:170:4 | ref arg bb | TAINT |
2077+
| vector.cpp:170:8:170:8 | call to operator[] [post update] | vector.cpp:170:5:170:5 | ref arg call to operator[] | TAINT |
2078+
| vector.cpp:170:14:170:19 | call to source | vector.cpp:170:3:170:21 | ... = ... | |
2079+
| vector.cpp:171:8:171:9 | bb | vector.cpp:171:10:171:10 | call to operator[] | TAINT |
2080+
| vector.cpp:171:8:171:9 | ref arg bb | vector.cpp:172:2:172:2 | bb | |
2081+
| vector.cpp:171:10:171:10 | call to operator[] | vector.cpp:171:13:171:13 | call to operator[] | TAINT |
2082+
| vector.cpp:171:10:171:10 | ref arg call to operator[] | vector.cpp:171:8:171:9 | ref arg bb | TAINT |
2083+
| vector.cpp:175:20:175:21 | call to vector | vector.cpp:175:20:175:21 | {...} | TAINT |
2084+
| vector.cpp:175:20:175:21 | {...} | vector.cpp:177:3:177:4 | cc | |
2085+
| vector.cpp:175:20:175:21 | {...} | vector.cpp:178:8:178:9 | cc | |
2086+
| vector.cpp:175:20:175:21 | {...} | vector.cpp:179:3:179:4 | cc | |
2087+
| vector.cpp:175:20:175:21 | {...} | vector.cpp:180:8:180:9 | cc | |
2088+
| vector.cpp:175:20:175:21 | {...} | vector.cpp:181:2:181:2 | cc | |
2089+
| vector.cpp:177:3:177:4 | cc | vector.cpp:177:3:177:7 | access to array | TAINT |
2090+
| vector.cpp:177:3:177:7 | ref arg access to array | vector.cpp:177:3:177:4 | cc [inner post update] | |
2091+
| vector.cpp:177:3:177:7 | ref arg access to array | vector.cpp:178:8:178:9 | cc | |
2092+
| vector.cpp:177:3:177:7 | ref arg access to array | vector.cpp:179:3:179:4 | cc | |
2093+
| vector.cpp:177:3:177:7 | ref arg access to array | vector.cpp:180:8:180:9 | cc | |
2094+
| vector.cpp:177:3:177:7 | ref arg access to array | vector.cpp:181:2:181:2 | cc | |
2095+
| vector.cpp:177:6:177:6 | 0 | vector.cpp:177:3:177:7 | access to array | TAINT |
2096+
| vector.cpp:177:19:177:19 | 0 | vector.cpp:177:3:177:7 | ref arg access to array | TAINT |
2097+
| vector.cpp:178:8:178:9 | cc | vector.cpp:178:8:178:12 | access to array | TAINT |
2098+
| vector.cpp:178:8:178:12 | access to array | vector.cpp:178:13:178:13 | call to operator[] | TAINT |
2099+
| vector.cpp:178:8:178:12 | ref arg access to array | vector.cpp:178:8:178:9 | cc [inner post update] | |
2100+
| vector.cpp:178:8:178:12 | ref arg access to array | vector.cpp:179:3:179:4 | cc | |
2101+
| vector.cpp:178:8:178:12 | ref arg access to array | vector.cpp:180:8:180:9 | cc | |
2102+
| vector.cpp:178:8:178:12 | ref arg access to array | vector.cpp:181:2:181:2 | cc | |
2103+
| vector.cpp:178:11:178:11 | 0 | vector.cpp:178:8:178:12 | access to array | TAINT |
2104+
| vector.cpp:179:3:179:4 | cc | vector.cpp:179:3:179:7 | access to array | TAINT |
2105+
| vector.cpp:179:3:179:7 | access to array | vector.cpp:179:8:179:8 | call to operator[] | TAINT |
2106+
| vector.cpp:179:3:179:7 | ref arg access to array | vector.cpp:179:3:179:4 | cc [inner post update] | |
2107+
| vector.cpp:179:3:179:7 | ref arg access to array | vector.cpp:180:8:180:9 | cc | |
2108+
| vector.cpp:179:3:179:7 | ref arg access to array | vector.cpp:181:2:181:2 | cc | |
2109+
| vector.cpp:179:3:179:21 | ... = ... | vector.cpp:179:8:179:8 | call to operator[] [post update] | |
2110+
| vector.cpp:179:6:179:6 | 0 | vector.cpp:179:3:179:7 | access to array | TAINT |
2111+
| vector.cpp:179:8:179:8 | call to operator[] [post update] | vector.cpp:179:3:179:7 | ref arg access to array | TAINT |
2112+
| vector.cpp:179:14:179:19 | call to source | vector.cpp:179:3:179:21 | ... = ... | |
2113+
| vector.cpp:180:8:180:9 | cc | vector.cpp:180:8:180:12 | access to array | TAINT |
2114+
| vector.cpp:180:8:180:12 | access to array | vector.cpp:180:13:180:13 | call to operator[] | TAINT |
2115+
| vector.cpp:180:8:180:12 | ref arg access to array | vector.cpp:180:8:180:9 | cc [inner post update] | |
2116+
| vector.cpp:180:8:180:12 | ref arg access to array | vector.cpp:181:2:181:2 | cc | |
2117+
| vector.cpp:180:11:180:11 | 0 | vector.cpp:180:8:180:12 | access to array | TAINT |
2118+
| vector.cpp:184:23:184:24 | call to vector | vector.cpp:187:3:187:4 | dd | |
2119+
| vector.cpp:184:23:184:24 | call to vector | vector.cpp:188:8:188:9 | dd | |
2120+
| vector.cpp:184:23:184:24 | call to vector | vector.cpp:189:8:189:9 | dd | |
2121+
| vector.cpp:184:23:184:24 | call to vector | vector.cpp:190:3:190:4 | dd | |
2122+
| vector.cpp:184:23:184:24 | call to vector | vector.cpp:191:8:191:9 | dd | |
2123+
| vector.cpp:184:23:184:24 | call to vector | vector.cpp:192:8:192:9 | dd | |
2124+
| vector.cpp:184:23:184:24 | call to vector | vector.cpp:193:2:193:2 | dd | |
2125+
| vector.cpp:185:14:185:20 | {...} | vector.cpp:187:16:187:17 | mp | |
2126+
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:188:8:188:9 | dd | |
2127+
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:189:8:189:9 | dd | |
2128+
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:190:3:190:4 | dd | |
2129+
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:191:8:191:9 | dd | |
2130+
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
2131+
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
2132+
| vector.cpp:187:16:187:17 | mp | vector.cpp:187:3:187:4 | ref arg dd | TAINT |
2133+
| vector.cpp:188:8:188:9 | dd | vector.cpp:188:10:188:10 | call to operator[] | TAINT |
2134+
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:189:8:189:9 | dd | |
2135+
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:190:3:190:4 | dd | |
2136+
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:191:8:191:9 | dd | |
2137+
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
2138+
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
2139+
| vector.cpp:189:8:189:9 | dd | vector.cpp:189:10:189:10 | call to operator[] | TAINT |
2140+
| vector.cpp:189:8:189:9 | ref arg dd | vector.cpp:190:3:190:4 | dd | |
2141+
| vector.cpp:189:8:189:9 | ref arg dd | vector.cpp:191:8:191:9 | dd | |
2142+
| vector.cpp:189:8:189:9 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
2143+
| vector.cpp:189:8:189:9 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
2144+
| vector.cpp:190:3:190:4 | dd | vector.cpp:190:5:190:5 | call to operator[] | TAINT |
2145+
| vector.cpp:190:3:190:4 | ref arg dd | vector.cpp:191:8:191:9 | dd | |
2146+
| vector.cpp:190:3:190:4 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
2147+
| vector.cpp:190:3:190:4 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
2148+
| vector.cpp:190:3:190:20 | ... = ... | vector.cpp:190:9:190:9 | a [post update] | |
2149+
| vector.cpp:190:5:190:5 | call to operator[] [post update] | vector.cpp:190:3:190:4 | ref arg dd | TAINT |
2150+
| vector.cpp:190:13:190:18 | call to source | vector.cpp:190:3:190:20 | ... = ... | |
2151+
| vector.cpp:191:8:191:9 | dd | vector.cpp:191:10:191:10 | call to operator[] | TAINT |
2152+
| vector.cpp:191:8:191:9 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
2153+
| vector.cpp:191:8:191:9 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
2154+
| vector.cpp:192:8:192:9 | dd | vector.cpp:192:10:192:10 | call to operator[] | TAINT |
2155+
| vector.cpp:192:8:192:9 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
2156+
| vector.cpp:196:21:196:22 | call to MyVectorContainer | vector.cpp:198:3:198:4 | ee | |
2157+
| vector.cpp:196:21:196:22 | call to MyVectorContainer | vector.cpp:199:8:199:9 | ee | |
2158+
| vector.cpp:196:21:196:22 | call to MyVectorContainer | vector.cpp:200:3:200:4 | ee | |
2159+
| vector.cpp:196:21:196:22 | call to MyVectorContainer | vector.cpp:201:8:201:9 | ee | |
2160+
| vector.cpp:196:21:196:22 | call to MyVectorContainer | vector.cpp:202:2:202:2 | ee | |
2161+
| vector.cpp:198:3:198:4 | ee [post update] | vector.cpp:199:8:199:9 | ee | |
2162+
| vector.cpp:198:3:198:4 | ee [post update] | vector.cpp:200:3:200:4 | ee | |
2163+
| vector.cpp:198:3:198:4 | ee [post update] | vector.cpp:201:8:201:9 | ee | |
2164+
| vector.cpp:198:3:198:4 | ee [post update] | vector.cpp:202:2:202:2 | ee | |
2165+
| vector.cpp:198:19:198:19 | 0 | vector.cpp:198:6:198:7 | ref arg vs | TAINT |
2166+
| vector.cpp:199:8:199:9 | ee [post update] | vector.cpp:200:3:200:4 | ee | |
2167+
| vector.cpp:199:8:199:9 | ee [post update] | vector.cpp:201:8:201:9 | ee | |
2168+
| vector.cpp:199:8:199:9 | ee [post update] | vector.cpp:202:2:202:2 | ee | |
2169+
| vector.cpp:199:11:199:12 | vs | vector.cpp:199:13:199:13 | call to operator[] | TAINT |
2170+
| vector.cpp:200:3:200:4 | ee [post update] | vector.cpp:201:8:201:9 | ee | |
2171+
| vector.cpp:200:3:200:4 | ee [post update] | vector.cpp:202:2:202:2 | ee | |
2172+
| vector.cpp:200:3:200:21 | ... = ... | vector.cpp:200:8:200:8 | call to operator[] [post update] | |
2173+
| vector.cpp:200:6:200:7 | vs | vector.cpp:200:8:200:8 | call to operator[] | TAINT |
2174+
| vector.cpp:200:8:200:8 | call to operator[] [post update] | vector.cpp:200:6:200:7 | ref arg vs | TAINT |
2175+
| vector.cpp:200:14:200:19 | call to source | vector.cpp:200:3:200:21 | ... = ... | |
2176+
| vector.cpp:201:8:201:9 | ee [post update] | vector.cpp:202:2:202:2 | ee | |
2177+
| vector.cpp:201:11:201:12 | vs | vector.cpp:201:13:201:13 | call to operator[] | TAINT |
2178+
| vector.cpp:205:34:205:35 | call to vector | vector.cpp:209:3:209:4 | ff | |
2179+
| vector.cpp:205:34:205:35 | call to vector | vector.cpp:210:8:210:9 | ff | |
2180+
| vector.cpp:205:34:205:35 | call to vector | vector.cpp:211:3:211:4 | ff | |
2181+
| vector.cpp:205:34:205:35 | call to vector | vector.cpp:212:8:212:9 | ff | |
2182+
| vector.cpp:205:34:205:35 | call to vector | vector.cpp:213:2:213:2 | ff | |
2183+
| vector.cpp:206:21:206:23 | call to MyVectorContainer | vector.cpp:208:3:208:5 | mvc | |
2184+
| vector.cpp:206:21:206:23 | call to MyVectorContainer | vector.cpp:209:16:209:18 | mvc | |
2185+
| vector.cpp:206:21:206:23 | call to MyVectorContainer | vector.cpp:213:2:213:2 | mvc | |
2186+
| vector.cpp:208:3:208:5 | mvc [post update] | vector.cpp:209:16:209:18 | mvc | |
2187+
| vector.cpp:208:3:208:5 | mvc [post update] | vector.cpp:213:2:213:2 | mvc | |
2188+
| vector.cpp:208:20:208:20 | 0 | vector.cpp:208:7:208:8 | ref arg vs | TAINT |
2189+
| vector.cpp:209:3:209:4 | ref arg ff | vector.cpp:210:8:210:9 | ff | |
2190+
| vector.cpp:209:3:209:4 | ref arg ff | vector.cpp:211:3:211:4 | ff | |
2191+
| vector.cpp:209:3:209:4 | ref arg ff | vector.cpp:212:8:212:9 | ff | |
2192+
| vector.cpp:209:3:209:4 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
2193+
| vector.cpp:209:16:209:18 | mvc | vector.cpp:209:3:209:4 | ref arg ff | TAINT |
2194+
| vector.cpp:210:8:210:9 | ff | vector.cpp:210:10:210:10 | call to operator[] | TAINT |
2195+
| vector.cpp:210:8:210:9 | ref arg ff | vector.cpp:211:3:211:4 | ff | |
2196+
| vector.cpp:210:8:210:9 | ref arg ff | vector.cpp:212:8:212:9 | ff | |
2197+
| vector.cpp:210:8:210:9 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
2198+
| vector.cpp:210:10:210:10 | call to operator[] [post update] | vector.cpp:210:8:210:9 | ref arg ff | TAINT |
2199+
| vector.cpp:210:14:210:15 | vs | vector.cpp:210:16:210:16 | call to operator[] | TAINT |
2200+
| vector.cpp:211:3:211:4 | ff | vector.cpp:211:5:211:5 | call to operator[] | TAINT |
2201+
| vector.cpp:211:3:211:4 | ref arg ff | vector.cpp:212:8:212:9 | ff | |
2202+
| vector.cpp:211:3:211:4 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
2203+
| vector.cpp:211:3:211:24 | ... = ... | vector.cpp:211:11:211:11 | call to operator[] [post update] | |
2204+
| vector.cpp:211:5:211:5 | call to operator[] [post update] | vector.cpp:211:3:211:4 | ref arg ff | TAINT |
2205+
| vector.cpp:211:9:211:10 | vs | vector.cpp:211:11:211:11 | call to operator[] | TAINT |
2206+
| vector.cpp:211:11:211:11 | call to operator[] [post update] | vector.cpp:211:9:211:10 | ref arg vs | TAINT |
2207+
| vector.cpp:211:17:211:22 | call to source | vector.cpp:211:3:211:24 | ... = ... | |
2208+
| vector.cpp:212:8:212:9 | ff | vector.cpp:212:10:212:10 | call to operator[] | TAINT |
2209+
| vector.cpp:212:8:212:9 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
2210+
| vector.cpp:212:10:212:10 | call to operator[] [post update] | vector.cpp:212:8:212:9 | ref arg ff | TAINT |
2211+
| vector.cpp:212:14:212:15 | vs | vector.cpp:212:16:212:16 | call to operator[] | TAINT |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,3 +234,6 @@
234234
| vector.cpp:139:7:139:8 | v1 | vector.cpp:126:15:126:20 | call to source |
235235
| vector.cpp:140:7:140:8 | v2 | vector.cpp:127:15:127:20 | call to source |
236236
| vector.cpp:141:7:141:8 | v3 | vector.cpp:128:15:128:20 | call to source |
237+
| vector.cpp:171:13:171:13 | call to operator[] | vector.cpp:170:14:170:19 | call to source |
238+
| vector.cpp:180:13:180:13 | call to operator[] | vector.cpp:179:14:179:19 | call to source |
239+
| vector.cpp:201:13:201:13 | call to operator[] | vector.cpp:200:14:200:19 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,3 +169,7 @@
169169
| vector.cpp:139:7:139:8 | vector.cpp:126:15:126:20 | AST only |
170170
| vector.cpp:140:7:140:8 | vector.cpp:127:15:127:20 | AST only |
171171
| vector.cpp:141:7:141:8 | vector.cpp:128:15:128:20 | AST only |
172+
| vector.cpp:162:8:162:15 | vector.cpp:161:14:161:19 | IR only |
173+
| vector.cpp:171:13:171:13 | vector.cpp:170:14:170:19 | AST only |
174+
| vector.cpp:180:13:180:13 | vector.cpp:179:14:179:19 | AST only |
175+
| vector.cpp:201:13:201:13 | vector.cpp:200:14:200:19 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,3 +79,4 @@
7979
| taint.cpp:465:7:465:7 | x | taint.cpp:462:6:462:11 | call to source |
8080
| taint.cpp:470:7:470:7 | x | taint.cpp:462:6:462:11 | call to source |
8181
| taint.cpp:485:7:485:10 | line | taint.cpp:480:26:480:32 | source1 |
82+
| vector.cpp:162:8:162:15 | access to array | vector.cpp:161:14:161:19 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,3 +141,74 @@ void test_vector_clear() {
141141
sink(v3); // [FALSE POSITIVE]
142142
sink(v4);
143143
}
144+
145+
struct MyPair
146+
{
147+
int a, b;
148+
};
149+
150+
struct MyVectorContainer
151+
{
152+
std::vector<int> vs;
153+
};
154+
155+
void test_nested_vectors()
156+
{
157+
{
158+
int aa[10][20] = {0};
159+
160+
sink(aa[0][0]);
161+
aa[0][0] = source();
162+
sink(aa[0][0]); // tainted [IR ONLY]
163+
}
164+
165+
{
166+
std::vector<std::vector<int> > bb(30);
167+
168+
bb[0].push_back(0);
169+
sink(bb[0][0]);
170+
bb[0][0] = source();
171+
sink(bb[0][0]); // tainted
172+
}
173+
174+
{
175+
std::vector<int> cc[40];
176+
177+
cc[0].push_back(0);
178+
sink(cc[0][0]);
179+
cc[0][0] = source();
180+
sink(cc[0][0]); // tainted
181+
}
182+
183+
{
184+
std::vector<MyPair> dd;
185+
MyPair mp = {0, 0};
186+
187+
dd.push_back(mp);
188+
sink(dd[0].a);
189+
sink(dd[0].b);
190+
dd[0].a = source();
191+
sink(dd[0].a); // tainted [NOT DETECTED]
192+
sink(dd[0].b);
193+
}
194+
195+
{
196+
MyVectorContainer ee;
197+
198+
ee.vs.push_back(0);
199+
sink(ee.vs[0]);
200+
ee.vs[0] = source();
201+
sink(ee.vs[0]); // tainted
202+
}
203+
204+
{
205+
std::vector<MyVectorContainer> ff;
206+
MyVectorContainer mvc;
207+
208+
mvc.vs.push_back(0);
209+
ff.push_back(mvc);
210+
sink(ff[0].vs[0]);
211+
ff[0].vs[0] = source();
212+
sink(ff[0].vs[0]); // tainted [NOT DETECTED]
213+
}
214+
}

0 commit comments

Comments
 (0)