Skip to content

Commit 270517d

Browse files
geoffw0geoffw0
committed
C++: Revise model of emplace and emplace_hint. Note that 2 of the 3 taint regressions we shouldn't be getting because we don't yet do taint through keys.
1 parent 49c121d commit 270517d

File tree

6 files changed

+9
-42
lines changed

6 files changed

+9
-42
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,11 @@ class StdMapEmplace extends TaintFunction {
6060
}
6161

6262
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
63-
// flow from any parameter to qualifier and return value
64-
// (here we assume taint flow from any constructor parameter to the constructed object)
63+
// flow from the last parameter (which may be the value part used to
64+
// construct a pair, or a pair to be copied / moved) to the qualifier and
65+
// return value.
6566
// (where the return value is a pair, this should really flow just to the first part of it)
66-
input.isParameterDeref([0 .. getNumberOfParameters() - 1]) and
67+
input.isParameterDeref(getNumberOfParameters() - 1) and
6768
(
6869
output.isQualifierObject() or
6970
output.isReturnValue()

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 2 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1111,16 +1111,12 @@
11111111
| map.cpp:233:7:233:9 | ref arg m24 | map.cpp:235:7:235:9 | m24 | |
11121112
| map.cpp:233:7:233:9 | ref arg m24 | map.cpp:236:7:236:9 | m24 | |
11131113
| map.cpp:233:7:233:9 | ref arg m24 | map.cpp:252:1:252:1 | m24 | |
1114-
| map.cpp:233:19:233:23 | abc | map.cpp:233:7:233:9 | ref arg m24 | TAINT |
1115-
| map.cpp:233:19:233:23 | abc | map.cpp:233:11:233:17 | call to emplace | TAINT |
11161114
| map.cpp:233:26:233:30 | def | map.cpp:233:7:233:9 | ref arg m24 | TAINT |
11171115
| map.cpp:233:26:233:30 | def | map.cpp:233:11:233:17 | call to emplace | TAINT |
11181116
| map.cpp:233:33:233:37 | first | map.cpp:233:7:233:37 | call to iterator | |
11191117
| map.cpp:234:7:234:9 | m24 | map.cpp:234:7:234:9 | call to map | |
11201118
| map.cpp:235:7:235:9 | ref arg m24 | map.cpp:236:7:236:9 | m24 | |
11211119
| map.cpp:235:7:235:9 | ref arg m24 | map.cpp:252:1:252:1 | m24 | |
1122-
| map.cpp:235:19:235:23 | abc | map.cpp:235:7:235:9 | ref arg m24 | TAINT |
1123-
| map.cpp:235:19:235:23 | abc | map.cpp:235:11:235:17 | call to emplace | TAINT |
11241120
| map.cpp:235:26:235:31 | call to source | map.cpp:235:7:235:9 | ref arg m24 | TAINT |
11251121
| map.cpp:235:26:235:31 | call to source | map.cpp:235:11:235:17 | call to emplace | TAINT |
11261122
| map.cpp:235:36:235:40 | first | map.cpp:235:7:235:40 | call to iterator | |
@@ -1137,11 +1133,7 @@
11371133
| map.cpp:237:24:237:26 | ref arg m25 | map.cpp:239:24:239:26 | m25 | |
11381134
| map.cpp:237:24:237:26 | ref arg m25 | map.cpp:240:7:240:9 | m25 | |
11391135
| map.cpp:237:24:237:26 | ref arg m25 | map.cpp:252:1:252:1 | m25 | |
1140-
| map.cpp:237:24:237:34 | call to iterator | map.cpp:237:7:237:9 | ref arg m25 | TAINT |
1141-
| map.cpp:237:24:237:34 | call to iterator | map.cpp:237:11:237:22 | call to emplace_hint | TAINT |
11421136
| map.cpp:237:28:237:32 | call to begin | map.cpp:237:24:237:34 | call to iterator | TAINT |
1143-
| map.cpp:237:37:237:41 | abc | map.cpp:237:7:237:9 | ref arg m25 | TAINT |
1144-
| map.cpp:237:37:237:41 | abc | map.cpp:237:11:237:22 | call to emplace_hint | TAINT |
11451137
| map.cpp:237:44:237:48 | def | map.cpp:237:7:237:9 | ref arg m25 | TAINT |
11461138
| map.cpp:237:44:237:48 | def | map.cpp:237:11:237:22 | call to emplace_hint | TAINT |
11471139
| map.cpp:238:7:238:9 | m25 | map.cpp:238:7:238:9 | call to map | |
@@ -1151,11 +1143,7 @@
11511143
| map.cpp:239:24:239:26 | ref arg m25 | map.cpp:239:7:239:9 | m25 | |
11521144
| map.cpp:239:24:239:26 | ref arg m25 | map.cpp:240:7:240:9 | m25 | |
11531145
| map.cpp:239:24:239:26 | ref arg m25 | map.cpp:252:1:252:1 | m25 | |
1154-
| map.cpp:239:24:239:34 | call to iterator | map.cpp:239:7:239:9 | ref arg m25 | TAINT |
1155-
| map.cpp:239:24:239:34 | call to iterator | map.cpp:239:11:239:22 | call to emplace_hint | TAINT |
11561146
| map.cpp:239:28:239:32 | call to begin | map.cpp:239:24:239:34 | call to iterator | TAINT |
1157-
| map.cpp:239:37:239:41 | abc | map.cpp:239:7:239:9 | ref arg m25 | TAINT |
1158-
| map.cpp:239:37:239:41 | abc | map.cpp:239:11:239:22 | call to emplace_hint | TAINT |
11591147
| map.cpp:239:44:239:49 | call to source | map.cpp:239:7:239:9 | ref arg m25 | TAINT |
11601148
| map.cpp:239:44:239:49 | call to source | map.cpp:239:11:239:22 | call to emplace_hint | TAINT |
11611149
| map.cpp:240:7:240:9 | m25 | map.cpp:240:7:240:9 | call to map | |
@@ -1755,16 +1743,12 @@
17551743
| map.cpp:382:7:382:9 | ref arg m24 | map.cpp:384:7:384:9 | m24 | |
17561744
| map.cpp:382:7:382:9 | ref arg m24 | map.cpp:385:7:385:9 | m24 | |
17571745
| map.cpp:382:7:382:9 | ref arg m24 | map.cpp:438:1:438:1 | m24 | |
1758-
| map.cpp:382:19:382:23 | abc | map.cpp:382:7:382:9 | ref arg m24 | TAINT |
1759-
| map.cpp:382:19:382:23 | abc | map.cpp:382:11:382:17 | call to emplace | TAINT |
17601746
| map.cpp:382:26:382:30 | def | map.cpp:382:7:382:9 | ref arg m24 | TAINT |
17611747
| map.cpp:382:26:382:30 | def | map.cpp:382:11:382:17 | call to emplace | TAINT |
17621748
| map.cpp:382:33:382:37 | first | map.cpp:382:7:382:37 | call to iterator | |
17631749
| map.cpp:383:7:383:9 | m24 | map.cpp:383:7:383:9 | call to unordered_map | |
17641750
| map.cpp:384:7:384:9 | ref arg m24 | map.cpp:385:7:385:9 | m24 | |
17651751
| map.cpp:384:7:384:9 | ref arg m24 | map.cpp:438:1:438:1 | m24 | |
1766-
| map.cpp:384:19:384:23 | abc | map.cpp:384:7:384:9 | ref arg m24 | TAINT |
1767-
| map.cpp:384:19:384:23 | abc | map.cpp:384:11:384:17 | call to emplace | TAINT |
17681752
| map.cpp:384:26:384:31 | call to source | map.cpp:384:7:384:9 | ref arg m24 | TAINT |
17691753
| map.cpp:384:26:384:31 | call to source | map.cpp:384:11:384:17 | call to emplace | TAINT |
17701754
| map.cpp:384:36:384:40 | first | map.cpp:384:7:384:40 | call to iterator | |
@@ -1781,11 +1765,7 @@
17811765
| map.cpp:386:24:386:26 | ref arg m25 | map.cpp:388:24:388:26 | m25 | |
17821766
| map.cpp:386:24:386:26 | ref arg m25 | map.cpp:389:7:389:9 | m25 | |
17831767
| map.cpp:386:24:386:26 | ref arg m25 | map.cpp:438:1:438:1 | m25 | |
1784-
| map.cpp:386:24:386:34 | call to iterator | map.cpp:386:7:386:9 | ref arg m25 | TAINT |
1785-
| map.cpp:386:24:386:34 | call to iterator | map.cpp:386:11:386:22 | call to emplace_hint | TAINT |
17861768
| map.cpp:386:28:386:32 | call to begin | map.cpp:386:24:386:34 | call to iterator | TAINT |
1787-
| map.cpp:386:37:386:41 | abc | map.cpp:386:7:386:9 | ref arg m25 | TAINT |
1788-
| map.cpp:386:37:386:41 | abc | map.cpp:386:11:386:22 | call to emplace_hint | TAINT |
17891769
| map.cpp:386:44:386:48 | def | map.cpp:386:7:386:9 | ref arg m25 | TAINT |
17901770
| map.cpp:386:44:386:48 | def | map.cpp:386:11:386:22 | call to emplace_hint | TAINT |
17911771
| map.cpp:387:7:387:9 | m25 | map.cpp:387:7:387:9 | call to unordered_map | |
@@ -1795,11 +1775,7 @@
17951775
| map.cpp:388:24:388:26 | ref arg m25 | map.cpp:388:7:388:9 | m25 | |
17961776
| map.cpp:388:24:388:26 | ref arg m25 | map.cpp:389:7:389:9 | m25 | |
17971777
| map.cpp:388:24:388:26 | ref arg m25 | map.cpp:438:1:438:1 | m25 | |
1798-
| map.cpp:388:24:388:34 | call to iterator | map.cpp:388:7:388:9 | ref arg m25 | TAINT |
1799-
| map.cpp:388:24:388:34 | call to iterator | map.cpp:388:11:388:22 | call to emplace_hint | TAINT |
18001778
| map.cpp:388:28:388:32 | call to begin | map.cpp:388:24:388:34 | call to iterator | TAINT |
1801-
| map.cpp:388:37:388:41 | abc | map.cpp:388:7:388:9 | ref arg m25 | TAINT |
1802-
| map.cpp:388:37:388:41 | abc | map.cpp:388:11:388:22 | call to emplace_hint | TAINT |
18031779
| map.cpp:388:44:388:49 | call to source | map.cpp:388:7:388:9 | ref arg m25 | TAINT |
18041780
| map.cpp:388:44:388:49 | call to source | map.cpp:388:11:388:22 | call to emplace_hint | TAINT |
18051781
| map.cpp:389:7:389:9 | m25 | map.cpp:389:7:389:9 | call to unordered_map | |
@@ -1973,8 +1949,6 @@
19731949
| map.cpp:424:37:424:39 | call to unordered_map | map.cpp:438:1:438:1 | m33 | |
19741950
| map.cpp:425:7:425:9 | ref arg m33 | map.cpp:426:7:426:9 | m33 | |
19751951
| map.cpp:425:7:425:9 | ref arg m33 | map.cpp:438:1:438:1 | m33 | |
1976-
| map.cpp:425:19:425:24 | call to source | map.cpp:425:7:425:9 | ref arg m33 | TAINT |
1977-
| map.cpp:425:19:425:24 | call to source | map.cpp:425:11:425:17 | call to emplace | TAINT |
19781952
| map.cpp:425:29:425:33 | def | map.cpp:425:7:425:9 | ref arg m33 | TAINT |
19791953
| map.cpp:425:29:425:33 | def | map.cpp:425:11:425:17 | call to emplace | TAINT |
19801954
| map.cpp:425:36:425:40 | first | map.cpp:425:7:425:40 | call to iterator | |
@@ -2015,13 +1989,11 @@
20151989
| map.cpp:433:24:433:26 | m34 | map.cpp:433:28:433:32 | call to begin | TAINT |
20161990
| map.cpp:433:24:433:26 | ref arg m34 | map.cpp:433:7:433:9 | m34 | |
20171991
| map.cpp:433:24:433:26 | ref arg m34 | map.cpp:438:1:438:1 | m34 | |
2018-
| map.cpp:433:24:433:34 | call to iterator | map.cpp:433:7:433:9 | ref arg m34 | TAINT |
2019-
| map.cpp:433:24:433:34 | call to iterator | map.cpp:433:11:433:22 | call to emplace_hint | TAINT |
20201992
| map.cpp:433:28:433:32 | call to begin | map.cpp:433:24:433:34 | call to iterator | TAINT |
2021-
| map.cpp:433:37:433:41 | abc | map.cpp:433:7:433:9 | ref arg m34 | TAINT |
2022-
| map.cpp:433:37:433:41 | abc | map.cpp:433:11:433:22 | call to emplace_hint | TAINT |
20231993
| map.cpp:433:44:433:48 | def | map.cpp:433:7:433:9 | ref arg m34 | TAINT |
20241994
| map.cpp:433:44:433:48 | def | map.cpp:433:11:433:22 | call to emplace_hint | TAINT |
1995+
| map.cpp:434:7:434:9 | m35 | map.cpp:434:7:434:9 | ref arg m35 | TAINT |
1996+
| map.cpp:434:7:434:9 | m35 | map.cpp:434:11:434:17 | call to emplace | TAINT |
20251997
| map.cpp:434:7:434:9 | ref arg m35 | map.cpp:435:7:435:9 | m35 | |
20261998
| map.cpp:434:7:434:9 | ref arg m35 | map.cpp:436:7:436:9 | m35 | |
20271999
| map.cpp:434:7:434:9 | ref arg m35 | map.cpp:437:7:437:9 | m35 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -422,15 +422,15 @@ void test_unordered_map()
422422

423423
// additional emplace test cases
424424
std::unordered_map<char *, char *> m33;
425-
sink(m33.emplace(source(), "def").first); // tainted
426-
sink(m33); // tainted
425+
sink(m33.emplace(source(), "def").first); // tainted [NOT DETECTED]
426+
sink(m33); // tainted [NOT DETECTED]
427427

428428
std::unordered_map<char *, char *> m34, m35;
429429
sink(m34.emplace(std::pair<char *, char *>("abc", "def")).first);
430430
sink(m34);
431431
sink(m34.emplace(std::pair<char *, char *>("abc", source())).first); // tainted
432432
sink(m34); // tainted
433-
sink(m34.emplace_hint(m34.begin(), "abc", "def")); // tainted
433+
sink(m34.emplace_hint(m34.begin(), "abc", "def")); // tainted [NOT DETECTED]
434434
sink(m35.emplace().first);
435435
sink(m35);
436436
sink(m35.emplace(std::pair<char *, char *>(source(), "def")).first); // tainted [NOT DETECTED]

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -159,9 +159,7 @@
159159
| map.cpp:419:7:419:41 | call to pair | map.cpp:419:33:419:38 | call to source |
160160
| map.cpp:420:7:420:9 | call to unordered_map | map.cpp:419:33:419:38 | call to source |
161161
| map.cpp:421:7:421:16 | call to pair | map.cpp:419:33:419:38 | call to source |
162-
| map.cpp:426:7:426:9 | call to unordered_map | map.cpp:425:19:425:24 | call to source |
163162
| map.cpp:432:7:432:9 | call to unordered_map | map.cpp:431:52:431:57 | call to source |
164-
| map.cpp:433:11:433:22 | call to emplace_hint | map.cpp:431:52:431:57 | call to source |
165163
| movableclass.cpp:44:8:44:9 | s1 | movableclass.cpp:39:21:39:26 | call to source |
166164
| movableclass.cpp:45:8:45:9 | s2 | movableclass.cpp:40:23:40:28 | call to source |
167165
| movableclass.cpp:46:8:46:9 | s3 | movableclass.cpp:42:8:42:13 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,6 @@
128128
| map.cpp:418:7:418:16 | map.cpp:416:30:416:35 | AST only |
129129
| map.cpp:420:7:420:9 | map.cpp:419:33:419:38 | AST only |
130130
| map.cpp:421:7:421:16 | map.cpp:419:33:419:38 | AST only |
131-
| map.cpp:425:7:425:40 | map.cpp:425:19:425:24 | IR only |
132-
| map.cpp:426:7:426:9 | map.cpp:425:19:425:24 | AST only |
133131
| map.cpp:431:7:431:67 | map.cpp:431:52:431:57 | IR only |
134132
| map.cpp:432:7:432:9 | map.cpp:431:52:431:57 | AST only |
135133
| movableclass.cpp:65:11:65:11 | movableclass.cpp:65:13:65:18 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -125,9 +125,7 @@
125125
| map.cpp:401:11:401:21 | call to try_emplace | map.cpp:401:43:401:48 | call to source |
126126
| map.cpp:416:7:416:41 | call to pair | map.cpp:416:30:416:35 | call to source |
127127
| map.cpp:419:7:419:41 | call to pair | map.cpp:419:33:419:38 | call to source |
128-
| map.cpp:425:7:425:40 | call to iterator | map.cpp:425:19:425:24 | call to source |
129128
| map.cpp:431:7:431:67 | call to iterator | map.cpp:431:52:431:57 | call to source |
130-
| map.cpp:433:11:433:22 | call to emplace_hint | map.cpp:431:52:431:57 | call to source |
131129
| movableclass.cpp:44:8:44:9 | s1 | movableclass.cpp:39:21:39:26 | call to source |
132130
| movableclass.cpp:45:8:45:9 | s2 | movableclass.cpp:40:23:40:28 | call to source |
133131
| movableclass.cpp:46:8:46:9 | s3 | movableclass.cpp:42:8:42:13 | call to source |

0 commit comments

Comments
 (0)