Skip to content

Commit 5aff5c3

Browse files
committed
C++: Add AliasFunction model to MemcpyFunction.
1 parent 066f836 commit 5aff5c3

File tree

1 file changed

+18
-1
lines changed
  • cpp/ql/src/semmle/code/cpp/models/implementations

1 file changed

+18
-1
lines changed

cpp/ql/src/semmle/code/cpp/models/implementations/Memcpy.qll

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,16 @@
66
import semmle.code.cpp.Function
77
import semmle.code.cpp.models.interfaces.ArrayFunction
88
import semmle.code.cpp.models.interfaces.DataFlow
9+
import semmle.code.cpp.models.interfaces.Alias
910
import semmle.code.cpp.models.interfaces.SideEffect
1011
import semmle.code.cpp.models.interfaces.Taint
1112

1213
/**
1314
* The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant
1415
* `__builtin___memcpy_chk`.
1516
*/
16-
private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction {
17+
private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction,
18+
AliasFunction {
1719
MemcpyFunction() {
1820
// memcpy(dest, src, num)
1921
// memmove(dest, src, num)
@@ -82,4 +84,19 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
8284
i = getParamSrc()
8385
)
8486
}
87+
88+
override predicate parameterNeverEscapes(int index) {
89+
index = getParamSrc()
90+
or
91+
this.hasGlobalName("bcopy") and index = getParamDest()
92+
}
93+
94+
override predicate parameterEscapesOnlyViaReturn(int index) {
95+
not this.hasGlobalName("bcopy") and index = getParamDest()
96+
}
97+
98+
override predicate parameterIsAlwaysReturned(int index) {
99+
not this.hasGlobalName("bcopy") and
100+
index = getParamDest()
101+
}
85102
}

0 commit comments

Comments
 (0)