Skip to content

Commit 2bf8e47

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into default-taint-tracking-operand-instruction-interleaving
2 parents 7ccd48e + fd7dec7 commit 2bf8e47

File tree

124 files changed

+14724
-4297
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

124 files changed

+14724
-4297
lines changed

‎cpp/ql/src/semmle/code/cpp/commons/Printf.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -900,6 +900,7 @@ class FormatLiteral extends Literal {
900900
*/
901901
int getNumArgNeeded(int n) {
902902
exists(this.getConvSpecOffset(n)) and
903+
exists(this.getConversionChar(n)) and
903904
result = count(int mode | hasFormatArgumentIndexFor(n, mode))
904905
}
905906

‎cpp/ql/src/semmle/code/cpp/models/implementations/Allocation.qll‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,9 @@ private class AllocaAllocationFunction extends AllocationFunction {
8282
hasGlobalName([
8383
// --- stack allocation
8484
"alloca", // // alloca(size)
85-
"__builtin_alloca" // __builtin_alloca(size)
85+
"__builtin_alloca", // __builtin_alloca(size)
86+
"_alloca", // _alloca(size)
87+
"_malloca" // _malloca(size)
8688
]) and
8789
sizeArg = 0
8890
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -165,24 +165,6 @@ private class StdSequenceContainerAssign extends TaintFunction {
165165
}
166166
}
167167

168-
/**
169-
* The standard container `swap` functions.
170-
*/
171-
private class StdSequenceContainerSwap extends TaintFunction {
172-
StdSequenceContainerSwap() {
173-
this.hasQualifiedName("std", ["array", "vector", "deque", "list", "forward_list"], "swap")
174-
}
175-
176-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
177-
// container1.swap(container2)
178-
input.isQualifierObject() and
179-
output.isParameterDeref(0)
180-
or
181-
input.isParameterDeref(0) and
182-
output.isQualifierObject()
183-
}
184-
}
185-
186168
/**
187169
* The standard container functions `at` and `operator[]`.
188170
*/

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -102,22 +102,6 @@ private class StdMapTryEmplace extends TaintFunction {
102102
}
103103
}
104104

105-
/**
106-
* The standard map `swap` function.
107-
*/
108-
private class StdMapSwap extends TaintFunction {
109-
StdMapSwap() { this.hasQualifiedName("std", ["map", "unordered_map"], "swap") }
110-
111-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
112-
// container1.swap(container2)
113-
input.isQualifierObject() and
114-
output.isParameterDeref(0)
115-
or
116-
input.isParameterDeref(0) and
117-
output.isQualifierObject()
118-
}
119-
}
120-
121105
/**
122106
* The standard map `merge` function.
123107
*/

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -60,19 +60,3 @@ private class StdPairConstructor extends Constructor, TaintFunction {
6060
)
6161
}
6262
}
63-
64-
/**
65-
* The standard pair `swap` function.
66-
*/
67-
private class StdPairSwap extends TaintFunction {
68-
StdPairSwap() { this.hasQualifiedName("std", "pair", "swap") }
69-
70-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
71-
// container1.swap(container2)
72-
input.isQualifierObject() and
73-
output.isParameterDeref(0)
74-
or
75-
input.isParameterDeref(0) and
76-
output.isQualifierObject()
77-
}
78-
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -72,22 +72,6 @@ private class StdSetEmplace extends TaintFunction {
7272
}
7373
}
7474

75-
/**
76-
* The standard set `swap` functions.
77-
*/
78-
private class StdSetSwap extends TaintFunction {
79-
StdSetSwap() { this.hasQualifiedName("std", ["set", "unordered_set"], "swap") }
80-
81-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
82-
// container1.swap(container2)
83-
input.isQualifierObject() and
84-
output.isParameterDeref(0)
85-
or
86-
input.isParameterDeref(0) and
87-
output.isQualifierObject()
88-
}
89-
}
90-
9175
/**
9276
* The standard set `merge` function.
9377
*/

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdString.qll‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -252,22 +252,6 @@ private class StdStringSubstr extends TaintFunction {
252252
}
253253
}
254254

255-
/**
256-
* The standard functions `std::string.swap` and `std::stringstream::swap`.
257-
*/
258-
private class StdStringSwap extends TaintFunction {
259-
StdStringSwap() { this.hasQualifiedName("std", ["basic_string", "basic_stringstream"], "swap") }
260-
261-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
262-
// str1.swap(str2)
263-
input.isQualifierObject() and
264-
output.isParameterDeref(0)
265-
or
266-
input.isParameterDeref(0) and
267-
output.isQualifierObject()
268-
}
269-
}
270-
271255
/**
272256
* The `std::string` functions `at` and `operator[]`.
273257
*/

‎cpp/ql/src/semmle/code/cpp/models/implementations/Strdup.qll‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import semmle.code.cpp.models.interfaces.Taint
1414
private class StrdupFunction extends AllocationFunction, ArrayFunction, DataFlowFunction {
1515
StrdupFunction() {
1616
hasGlobalName([
17+
// --- C library allocation
1718
"strdup", // strdup(str)
1819
"wcsdup", // wcsdup(str)
1920
"_strdup", // _strdup(str)
@@ -39,8 +40,8 @@ private class StrndupFunction extends AllocationFunction, ArrayFunction, DataFlo
3940
StrndupFunction() {
4041
exists(string name |
4142
hasGlobalName(name) and
42-
// strndup(str, maxlen)
43-
name = "strndup"
43+
// --- C library allocation
44+
name = "strndup" // strndup(str, maxlen)
4445
)
4546
}
4647

‎cpp/ql/src/semmle/code/cpp/models/implementations/Swap.qll‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,12 @@
11
import semmle.code.cpp.models.interfaces.DataFlow
22
import semmle.code.cpp.models.interfaces.Taint
3+
import semmle.code.cpp.models.interfaces.Alias
34

45
/**
5-
* The standard function `swap`.
6+
* The standard function `swap`. A use of `swap` looks like this:
7+
* ```
8+
* std::swap(obj1, obj2)
9+
* ```
610
*/
711
private class Swap extends DataFlowFunction {
812
Swap() { this.hasQualifiedName("std", "swap") }
@@ -15,3 +19,32 @@ private class Swap extends DataFlowFunction {
1519
output.isParameterDeref(0)
1620
}
1721
}
22+
23+
/**
24+
* A `swap` member function that is used as follows:
25+
* ```
26+
* obj1.swap(obj2)
27+
* ```
28+
*/
29+
private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction {
30+
MemberSwap() {
31+
this.hasName("swap") and
32+
this.getNumberOfParameters() = 1 and
33+
this.getParameter(0).getType().(ReferenceType).getBaseType().getUnspecifiedType() =
34+
getDeclaringType()
35+
}
36+
37+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
38+
input.isQualifierObject() and
39+
output.isParameterDeref(0)
40+
or
41+
input.isParameterDeref(0) and
42+
output.isQualifierObject()
43+
}
44+
45+
override predicate parameterNeverEscapes(int index) { none() }
46+
47+
override predicate parameterEscapesOnlyViaReturn(int index) { index = 0 }
48+
49+
override predicate parameterIsAlwaysReturned(int index) { index = 0 }
50+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5004,7 +5004,9 @@
50045004
| swap1.cpp:24:9:24:13 | this | swap1.cpp:24:31:24:34 | this | |
50055005
| swap1.cpp:24:23:24:26 | that | swap1.cpp:24:23:24:26 | that | |
50065006
| swap1.cpp:24:23:24:26 | that | swap1.cpp:24:36:24:39 | that | |
5007+
| swap1.cpp:24:31:24:34 | this | swap1.cpp:24:36:24:39 | ref arg that | TAINT |
50075008
| swap1.cpp:24:36:24:39 | ref arg that | swap1.cpp:24:23:24:26 | that | |
5009+
| swap1.cpp:24:36:24:39 | that | swap1.cpp:24:31:24:34 | ref arg this | TAINT |
50085010
| swap1.cpp:25:9:25:13 | this | swap1.cpp:25:36:25:52 | constructor init of field data1 [pre-this] | |
50095011
| swap1.cpp:25:28:25:31 | that | swap1.cpp:25:42:25:45 | that | |
50105012
| swap1.cpp:25:47:25:51 | data1 | swap1.cpp:25:36:25:52 | constructor init of field data1 | TAINT |
@@ -5014,28 +5016,36 @@
50145016
| swap1.cpp:29:23:29:27 | call to Class | swap1.cpp:30:18:30:20 | tmp | |
50155017
| swap1.cpp:29:24:29:27 | that | swap1.cpp:29:23:29:27 | call to Class | |
50165018
| swap1.cpp:30:13:30:16 | ref arg this | swap1.cpp:31:21:31:24 | this | |
5019+
| swap1.cpp:30:13:30:16 | this | swap1.cpp:30:18:30:20 | ref arg tmp | TAINT |
50175020
| swap1.cpp:30:13:30:16 | this | swap1.cpp:31:21:31:24 | this | |
5021+
| swap1.cpp:30:18:30:20 | tmp | swap1.cpp:30:13:30:16 | ref arg this | TAINT |
50185022
| swap1.cpp:31:21:31:24 | this | swap1.cpp:31:20:31:24 | * ... | TAINT |
50195023
| swap1.cpp:34:16:34:24 | this | swap1.cpp:36:13:36:16 | this | |
50205024
| swap1.cpp:34:34:34:37 | that | swap1.cpp:34:34:34:37 | that | |
50215025
| swap1.cpp:34:34:34:37 | that | swap1.cpp:36:18:36:21 | that | |
50225026
| swap1.cpp:36:13:36:16 | ref arg this | swap1.cpp:37:21:37:24 | this | |
5027+
| swap1.cpp:36:13:36:16 | this | swap1.cpp:36:18:36:21 | ref arg that | TAINT |
50235028
| swap1.cpp:36:13:36:16 | this | swap1.cpp:37:21:37:24 | this | |
50245029
| swap1.cpp:36:18:36:21 | ref arg that | swap1.cpp:34:34:34:37 | that | |
5030+
| swap1.cpp:36:18:36:21 | that | swap1.cpp:36:13:36:16 | ref arg this | TAINT |
50255031
| swap1.cpp:37:21:37:24 | this | swap1.cpp:37:20:37:24 | * ... | TAINT |
50265032
| swap1.cpp:40:16:40:26 | this | swap1.cpp:43:13:43:16 | this | |
50275033
| swap1.cpp:40:41:40:44 | that | swap1.cpp:42:24:42:27 | that | |
50285034
| swap1.cpp:42:23:42:27 | call to Class | swap1.cpp:43:18:43:20 | tmp | |
50295035
| swap1.cpp:42:24:42:27 | that | swap1.cpp:42:23:42:27 | call to Class | |
50305036
| swap1.cpp:43:13:43:16 | ref arg this | swap1.cpp:44:21:44:24 | this | |
5037+
| swap1.cpp:43:13:43:16 | this | swap1.cpp:43:18:43:20 | ref arg tmp | TAINT |
50315038
| swap1.cpp:43:13:43:16 | this | swap1.cpp:44:21:44:24 | this | |
5039+
| swap1.cpp:43:18:43:20 | tmp | swap1.cpp:43:13:43:16 | ref arg this | TAINT |
50325040
| swap1.cpp:44:21:44:24 | this | swap1.cpp:44:20:44:24 | * ... | TAINT |
50335041
| swap1.cpp:47:16:47:26 | this | swap1.cpp:49:13:49:16 | this | |
50345042
| swap1.cpp:47:36:47:39 | that | swap1.cpp:47:36:47:39 | that | |
50355043
| swap1.cpp:47:36:47:39 | that | swap1.cpp:49:18:49:21 | that | |
50365044
| swap1.cpp:49:13:49:16 | ref arg this | swap1.cpp:50:21:50:24 | this | |
5045+
| swap1.cpp:49:13:49:16 | this | swap1.cpp:49:18:49:21 | ref arg that | TAINT |
50375046
| swap1.cpp:49:13:49:16 | this | swap1.cpp:50:21:50:24 | this | |
50385047
| swap1.cpp:49:18:49:21 | ref arg that | swap1.cpp:47:36:47:39 | that | |
5048+
| swap1.cpp:49:18:49:21 | that | swap1.cpp:49:13:49:16 | ref arg this | TAINT |
50395049
| swap1.cpp:50:21:50:24 | this | swap1.cpp:50:20:50:24 | * ... | TAINT |
50405050
| swap1.cpp:53:14:53:17 | this | swap1.cpp:56:18:56:22 | this | |
50415051
| swap1.cpp:53:26:53:29 | that | swap1.cpp:53:26:53:29 | that | |
@@ -5049,7 +5059,9 @@
50495059
| swap1.cpp:61:32:61:32 | y | swap1.cpp:61:32:61:32 | y | |
50505060
| swap1.cpp:61:32:61:32 | y | swap1.cpp:63:16:63:16 | y | |
50515061
| swap1.cpp:63:9:63:9 | ref arg x | swap1.cpp:61:22:61:22 | x | |
5062+
| swap1.cpp:63:9:63:9 | x | swap1.cpp:63:16:63:16 | ref arg y | TAINT |
50525063
| swap1.cpp:63:16:63:16 | ref arg y | swap1.cpp:61:32:61:32 | y | |
5064+
| swap1.cpp:63:16:63:16 | y | swap1.cpp:63:9:63:9 | ref arg x | TAINT |
50535065
| swap1.cpp:69:23:69:23 | x | swap1.cpp:71:5:71:5 | x | |
50545066
| swap1.cpp:69:23:69:23 | x | swap1.cpp:73:10:73:10 | x | |
50555067
| swap1.cpp:69:23:69:23 | x | swap1.cpp:76:9:76:9 | x | |
@@ -5158,7 +5170,9 @@
51585170
| swap2.cpp:24:9:24:13 | this | swap2.cpp:24:31:24:34 | this | |
51595171
| swap2.cpp:24:23:24:26 | that | swap2.cpp:24:23:24:26 | that | |
51605172
| swap2.cpp:24:23:24:26 | that | swap2.cpp:24:36:24:39 | that | |
5173+
| swap2.cpp:24:31:24:34 | this | swap2.cpp:24:36:24:39 | ref arg that | TAINT |
51615174
| swap2.cpp:24:36:24:39 | ref arg that | swap2.cpp:24:23:24:26 | that | |
5175+
| swap2.cpp:24:36:24:39 | that | swap2.cpp:24:31:24:34 | ref arg this | TAINT |
51625176
| swap2.cpp:25:9:25:13 | this | swap2.cpp:25:36:25:52 | constructor init of field data1 [pre-this] | |
51635177
| swap2.cpp:25:28:25:31 | that | swap2.cpp:25:42:25:45 | that | |
51645178
| swap2.cpp:25:28:25:31 | that | swap2.cpp:25:61:25:64 | that | |
@@ -5173,28 +5187,36 @@
51735187
| swap2.cpp:29:23:29:27 | call to Class | swap2.cpp:30:18:30:20 | tmp | |
51745188
| swap2.cpp:29:24:29:27 | that | swap2.cpp:29:23:29:27 | call to Class | |
51755189
| swap2.cpp:30:13:30:16 | ref arg this | swap2.cpp:31:21:31:24 | this | |
5190+
| swap2.cpp:30:13:30:16 | this | swap2.cpp:30:18:30:20 | ref arg tmp | TAINT |
51765191
| swap2.cpp:30:13:30:16 | this | swap2.cpp:31:21:31:24 | this | |
5192+
| swap2.cpp:30:18:30:20 | tmp | swap2.cpp:30:13:30:16 | ref arg this | TAINT |
51775193
| swap2.cpp:31:21:31:24 | this | swap2.cpp:31:20:31:24 | * ... | TAINT |
51785194
| swap2.cpp:34:16:34:24 | this | swap2.cpp:36:13:36:16 | this | |
51795195
| swap2.cpp:34:34:34:37 | that | swap2.cpp:34:34:34:37 | that | |
51805196
| swap2.cpp:34:34:34:37 | that | swap2.cpp:36:18:36:21 | that | |
51815197
| swap2.cpp:36:13:36:16 | ref arg this | swap2.cpp:37:21:37:24 | this | |
5198+
| swap2.cpp:36:13:36:16 | this | swap2.cpp:36:18:36:21 | ref arg that | TAINT |
51825199
| swap2.cpp:36:13:36:16 | this | swap2.cpp:37:21:37:24 | this | |
51835200
| swap2.cpp:36:18:36:21 | ref arg that | swap2.cpp:34:34:34:37 | that | |
5201+
| swap2.cpp:36:18:36:21 | that | swap2.cpp:36:13:36:16 | ref arg this | TAINT |
51845202
| swap2.cpp:37:21:37:24 | this | swap2.cpp:37:20:37:24 | * ... | TAINT |
51855203
| swap2.cpp:40:16:40:26 | this | swap2.cpp:43:13:43:16 | this | |
51865204
| swap2.cpp:40:41:40:44 | that | swap2.cpp:42:24:42:27 | that | |
51875205
| swap2.cpp:42:23:42:27 | call to Class | swap2.cpp:43:18:43:20 | tmp | |
51885206
| swap2.cpp:42:24:42:27 | that | swap2.cpp:42:23:42:27 | call to Class | |
51895207
| swap2.cpp:43:13:43:16 | ref arg this | swap2.cpp:44:21:44:24 | this | |
5208+
| swap2.cpp:43:13:43:16 | this | swap2.cpp:43:18:43:20 | ref arg tmp | TAINT |
51905209
| swap2.cpp:43:13:43:16 | this | swap2.cpp:44:21:44:24 | this | |
5210+
| swap2.cpp:43:18:43:20 | tmp | swap2.cpp:43:13:43:16 | ref arg this | TAINT |
51915211
| swap2.cpp:44:21:44:24 | this | swap2.cpp:44:20:44:24 | * ... | TAINT |
51925212
| swap2.cpp:47:16:47:26 | this | swap2.cpp:49:13:49:16 | this | |
51935213
| swap2.cpp:47:36:47:39 | that | swap2.cpp:47:36:47:39 | that | |
51945214
| swap2.cpp:47:36:47:39 | that | swap2.cpp:49:18:49:21 | that | |
51955215
| swap2.cpp:49:13:49:16 | ref arg this | swap2.cpp:50:21:50:24 | this | |
5216+
| swap2.cpp:49:13:49:16 | this | swap2.cpp:49:18:49:21 | ref arg that | TAINT |
51965217
| swap2.cpp:49:13:49:16 | this | swap2.cpp:50:21:50:24 | this | |
51975218
| swap2.cpp:49:18:49:21 | ref arg that | swap2.cpp:47:36:47:39 | that | |
5219+
| swap2.cpp:49:18:49:21 | that | swap2.cpp:49:13:49:16 | ref arg this | TAINT |
51985220
| swap2.cpp:50:21:50:24 | this | swap2.cpp:50:20:50:24 | * ... | TAINT |
51995221
| swap2.cpp:53:14:53:17 | this | swap2.cpp:56:18:56:22 | this | |
52005222
| swap2.cpp:53:26:53:29 | that | swap2.cpp:53:26:53:29 | that | |
@@ -5216,7 +5238,9 @@
52165238
| swap2.cpp:61:32:61:32 | y | swap2.cpp:61:32:61:32 | y | |
52175239
| swap2.cpp:61:32:61:32 | y | swap2.cpp:63:16:63:16 | y | |
52185240
| swap2.cpp:63:9:63:9 | ref arg x | swap2.cpp:61:22:61:22 | x | |
5241+
| swap2.cpp:63:9:63:9 | x | swap2.cpp:63:16:63:16 | ref arg y | TAINT |
52195242
| swap2.cpp:63:16:63:16 | ref arg y | swap2.cpp:61:32:61:32 | y | |
5243+
| swap2.cpp:63:16:63:16 | y | swap2.cpp:63:9:63:9 | ref arg x | TAINT |
52205244
| swap2.cpp:69:23:69:23 | x | swap2.cpp:71:5:71:5 | x | |
52215245
| swap2.cpp:69:23:69:23 | x | swap2.cpp:73:10:73:10 | x | |
52225246
| swap2.cpp:69:23:69:23 | x | swap2.cpp:76:9:76:9 | x | |

0 commit comments

Comments
 (0)