Skip to content

Commit 5d87117

Browse files
geoffw0geoffw0
committed
C++: Model std::set::lower_bound, upper_bound, equal_range.
1 parent fc19bba commit 5d87117

File tree

6 files changed

+41
-6
lines changed

6 files changed

+41
-6
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdSet.qll‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,3 +103,20 @@ class StdSetErase extends TaintFunction {
103103
output.isReturnValue()
104104
}
105105
}
106+
107+
/**
108+
* The standard set `lower_bound`, `upper_bound` and `equal_range` functions.
109+
*/
110+
class StdSetEqualRange extends TaintFunction {
111+
StdSetEqualRange() {
112+
this
113+
.hasQualifiedName("std", ["set", "unordered_set"],
114+
["lower_bound", "upper_bound", "equal_range"])
115+
}
116+
117+
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
118+
// flow from qualifier to return value
119+
input.isQualifierObject() and
120+
output.isReturnValue()
121+
}
122+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2114,13 +2114,17 @@
21142114
| set.cpp:69:7:69:9 | ref arg s11 | set.cpp:71:7:71:9 | s11 | |
21152115
| set.cpp:69:7:69:9 | ref arg s11 | set.cpp:72:7:72:9 | s11 | |
21162116
| set.cpp:69:7:69:9 | ref arg s11 | set.cpp:126:1:126:1 | s11 | |
2117+
| set.cpp:69:7:69:9 | s11 | set.cpp:69:11:69:21 | call to lower_bound | TAINT |
21172118
| set.cpp:70:7:70:9 | ref arg s11 | set.cpp:71:7:71:9 | s11 | |
21182119
| set.cpp:70:7:70:9 | ref arg s11 | set.cpp:72:7:72:9 | s11 | |
21192120
| set.cpp:70:7:70:9 | ref arg s11 | set.cpp:126:1:126:1 | s11 | |
2121+
| set.cpp:70:7:70:9 | s11 | set.cpp:70:11:70:21 | call to upper_bound | TAINT |
21202122
| set.cpp:71:7:71:9 | ref arg s11 | set.cpp:72:7:72:9 | s11 | |
21212123
| set.cpp:71:7:71:9 | ref arg s11 | set.cpp:126:1:126:1 | s11 | |
2124+
| set.cpp:71:7:71:9 | s11 | set.cpp:71:11:71:21 | call to equal_range | TAINT |
21222125
| set.cpp:71:28:71:32 | first | set.cpp:71:7:71:32 | call to iterator | |
21232126
| set.cpp:72:7:72:9 | ref arg s11 | set.cpp:126:1:126:1 | s11 | |
2127+
| set.cpp:72:7:72:9 | s11 | set.cpp:72:11:72:21 | call to equal_range | TAINT |
21242128
| set.cpp:72:28:72:33 | second | set.cpp:72:7:72:33 | call to iterator | |
21252129
| set.cpp:75:19:75:21 | call to set | set.cpp:76:2:76:4 | s12 | |
21262130
| set.cpp:75:19:75:21 | call to set | set.cpp:78:7:78:9 | s12 | |
@@ -2582,8 +2586,10 @@
25822586
| set.cpp:182:13:182:15 | c | set.cpp:182:6:182:11 | call to insert | TAINT |
25832587
| set.cpp:183:7:183:9 | ref arg s11 | set.cpp:184:7:184:9 | s11 | |
25842588
| set.cpp:183:7:183:9 | ref arg s11 | set.cpp:238:1:238:1 | s11 | |
2589+
| set.cpp:183:7:183:9 | s11 | set.cpp:183:11:183:21 | call to equal_range | TAINT |
25852590
| set.cpp:183:28:183:32 | first | set.cpp:183:7:183:32 | call to iterator | |
25862591
| set.cpp:184:7:184:9 | ref arg s11 | set.cpp:238:1:238:1 | s11 | |
2592+
| set.cpp:184:7:184:9 | s11 | set.cpp:184:11:184:21 | call to equal_range | TAINT |
25872593
| set.cpp:184:28:184:33 | second | set.cpp:184:7:184:33 | call to iterator | |
25882594
| set.cpp:187:29:187:31 | call to unordered_set | set.cpp:188:2:188:4 | s12 | |
25892595
| set.cpp:187:29:187:31 | call to unordered_set | set.cpp:190:7:190:9 | s12 | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,10 @@ void test_set()
6666
s11.insert("a");
6767
s11.insert(source());
6868
s11.insert("c");
69-
sink(s11.lower_bound("b")); // tainted [NOT DETECTED]
70-
sink(s11.upper_bound("b")); // tainted [NOT DETECTED]
71-
sink(s11.equal_range("b").first); // tainted [NOT DETECTED]
72-
sink(s11.equal_range("b").second); // tainted [NOT DETECTED]
69+
sink(s11.lower_bound("b")); // tainted
70+
sink(s11.upper_bound("b")); // tainted
71+
sink(s11.equal_range("b").first); // tainted
72+
sink(s11.equal_range("b").second); // tainted
7373

7474
// swap
7575
std::set<char *> s12, s13, s14, s15;
@@ -180,8 +180,8 @@ void test_unordered_set()
180180
s11.insert("a");
181181
s11.insert(source());
182182
s11.insert("c");
183-
sink(s11.equal_range("b").first); // tainted [NOT DETECTED]
184-
sink(s11.equal_range("b").second); // tainted [NOT DETECTED]
183+
sink(s11.equal_range("b").first); // tainted
184+
sink(s11.equal_range("b").second); // tainted
185185

186186
// swap
187187
std::unordered_set<char *> s12, s13, s14, s15;

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,8 @@
158158
| set.cpp:50:10:50:13 | call to find | set.cpp:20:17:20:22 | call to source |
159159
| set.cpp:51:11:51:14 | call to find | set.cpp:20:17:20:22 | call to source |
160160
| set.cpp:61:8:61:8 | call to operator* | set.cpp:20:17:20:22 | call to source |
161+
| set.cpp:69:11:69:21 | call to lower_bound | set.cpp:67:13:67:18 | call to source |
162+
| set.cpp:70:11:70:21 | call to upper_bound | set.cpp:67:13:67:18 | call to source |
161163
| set.cpp:78:7:78:9 | call to set | set.cpp:76:13:76:18 | call to source |
162164
| set.cpp:81:7:81:9 | call to set | set.cpp:77:13:77:18 | call to source |
163165
| set.cpp:84:7:84:9 | call to set | set.cpp:76:13:76:18 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,8 @@
115115
| set.cpp:48:10:48:13 | set.cpp:20:17:20:22 | AST only |
116116
| set.cpp:49:10:49:13 | set.cpp:20:17:20:22 | AST only |
117117
| set.cpp:61:8:61:11 | set.cpp:20:17:20:22 | IR only |
118+
| set.cpp:71:7:71:32 | set.cpp:67:13:67:18 | IR only |
119+
| set.cpp:72:7:72:33 | set.cpp:67:13:67:18 | IR only |
118120
| set.cpp:78:7:78:9 | set.cpp:76:13:76:18 | AST only |
119121
| set.cpp:81:7:81:9 | set.cpp:77:13:77:18 | AST only |
120122
| set.cpp:84:7:84:9 | set.cpp:76:13:76:18 | AST only |
@@ -143,6 +145,8 @@
143145
| set.cpp:162:10:162:13 | set.cpp:134:17:134:22 | AST only |
144146
| set.cpp:163:10:163:13 | set.cpp:134:17:134:22 | AST only |
145147
| set.cpp:175:8:175:11 | set.cpp:134:17:134:22 | IR only |
148+
| set.cpp:183:7:183:32 | set.cpp:181:13:181:18 | IR only |
149+
| set.cpp:184:7:184:33 | set.cpp:181:13:181:18 | IR only |
146150
| set.cpp:190:7:190:9 | set.cpp:188:13:188:18 | AST only |
147151
| set.cpp:193:7:193:9 | set.cpp:189:13:189:18 | AST only |
148152
| set.cpp:196:7:196:9 | set.cpp:188:13:188:18 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,10 @@
121121
| set.cpp:51:11:51:14 | call to find | set.cpp:20:17:20:22 | call to source |
122122
| set.cpp:61:8:61:8 | call to operator* | set.cpp:20:17:20:22 | call to source |
123123
| set.cpp:61:8:61:11 | (reference dereference) | set.cpp:20:17:20:22 | call to source |
124+
| set.cpp:69:11:69:21 | call to lower_bound | set.cpp:67:13:67:18 | call to source |
125+
| set.cpp:70:11:70:21 | call to upper_bound | set.cpp:67:13:67:18 | call to source |
126+
| set.cpp:71:7:71:32 | call to iterator | set.cpp:67:13:67:18 | call to source |
127+
| set.cpp:72:7:72:33 | call to iterator | set.cpp:67:13:67:18 | call to source |
124128
| set.cpp:111:11:111:15 | call to erase | set.cpp:108:13:108:18 | call to source |
125129
| set.cpp:111:11:111:15 | call to erase | set.cpp:109:13:109:18 | call to source |
126130
| set.cpp:134:7:134:31 | call to iterator | set.cpp:134:17:134:22 | call to source |
@@ -132,6 +136,8 @@
132136
| set.cpp:165:11:165:14 | call to find | set.cpp:134:17:134:22 | call to source |
133137
| set.cpp:175:8:175:8 | call to operator* | set.cpp:134:17:134:22 | call to source |
134138
| set.cpp:175:8:175:11 | (reference dereference) | set.cpp:134:17:134:22 | call to source |
139+
| set.cpp:183:7:183:32 | call to iterator | set.cpp:181:13:181:18 | call to source |
140+
| set.cpp:184:7:184:33 | call to iterator | set.cpp:181:13:181:18 | call to source |
135141
| set.cpp:223:11:223:15 | call to erase | set.cpp:220:13:220:18 | call to source |
136142
| set.cpp:223:11:223:15 | call to erase | set.cpp:221:13:221:18 | call to source |
137143
| smart_pointer.cpp:13:10:13:10 | Argument 0 indirection | smart_pointer.cpp:11:52:11:57 | call to source |

0 commit comments

Comments
 (0)