Skip to content

Commit 6b2ae5d

Browse files
jbjjbj
authored
Merge pull request #4393 from MathiasVP/no-more-flow-into-read-side-effect
C++: No more flow into ReadSideEffect instructions
2 parents b7dcd5c + a6d7b1f commit 6b2ae5d

File tree

9 files changed

+115
-193
lines changed

9 files changed

+115
-193
lines changed

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 43 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,35 +5,58 @@ private import DataFlowDispatch
55

66
/**
77
* A data flow node that occurs as the argument of a call and is passed as-is
8-
* to the callable. Instance arguments (`this` pointer) are also included.
8+
* to the callable. Instance arguments (`this` pointer) and read side effects
9+
* on parameters are also included.
910
*/
10-
class ArgumentNode extends InstructionNode {
11-
ArgumentNode() {
12-
exists(CallInstruction call |
13-
instr = call.getAnArgument()
14-
or
15-
instr.(ReadSideEffectInstruction).getPrimaryInstruction() = call
16-
)
17-
}
18-
11+
abstract class ArgumentNode extends OperandNode {
1912
/**
2013
* Holds if this argument occurs at the given position in the given call.
2114
* The instance argument is considered to have index `-1`.
2215
*/
23-
predicate argumentOf(DataFlowCall call, int pos) {
24-
instr = call.getPositionalArgument(pos)
16+
abstract predicate argumentOf(DataFlowCall call, int pos);
17+
18+
/** Gets the call in which this node is an argument. */
19+
DataFlowCall getCall() { this.argumentOf(result, _) }
20+
}
21+
22+
/**
23+
* A data flow node that occurs as the argument to a call, or an
24+
* implicit `this` pointer argument.
25+
*/
26+
private class PrimaryArgumentNode extends ArgumentNode {
27+
override ArgumentOperand op;
28+
29+
PrimaryArgumentNode() { exists(CallInstruction call | op = call.getAnArgumentOperand()) }
30+
31+
override predicate argumentOf(DataFlowCall call, int pos) {
32+
op = call.getPositionalArgumentOperand(pos)
2533
or
26-
instr = call.getThisArgument() and pos = -1
34+
op = call.getThisArgumentOperand() and pos = -1
35+
}
36+
37+
override string toString() {
38+
result = "Argument " + op.(PositionalArgumentOperand).getIndex()
2739
or
28-
exists(ReadSideEffectInstruction read |
29-
read = instr and
30-
read.getPrimaryInstruction() = call and
31-
pos = getArgumentPosOfSideEffect(read.getIndex())
32-
)
40+
op instanceof ThisArgumentOperand and result = "This argument"
3341
}
42+
}
3443

35-
/** Gets the call in which this node is an argument. */
36-
DataFlowCall getCall() { this.argumentOf(result, _) }
44+
/**
45+
* A data flow node representing the read side effect of a call on a
46+
* specific parameter.
47+
*/
48+
private class SideEffectArgumentNode extends ArgumentNode {
49+
override SideEffectOperand op;
50+
ReadSideEffectInstruction read;
51+
52+
SideEffectArgumentNode() { op = read.getSideEffectOperand() }
53+
54+
override predicate argumentOf(DataFlowCall call, int pos) {
55+
read.getPrimaryInstruction() = call and
56+
pos = getArgumentPosOfSideEffect(read.getIndex())
57+
}
58+
59+
override string toString() { result = "Argument " + read.getIndex() + " indirection" }
3760
}
3861

3962
private newtype TReturnKind =

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -505,18 +505,6 @@ class DefinitionByReferenceNode extends InstructionNode {
505505
}
506506
}
507507

508-
/**
509-
* A node representing the memory pointed to by a function argument.
510-
*
511-
* This class exists only in order to override `toString`, which would
512-
* otherwise be the default implementation inherited from `InstructionNode`.
513-
*/
514-
private class ArgumentIndirectionNode extends InstructionNode {
515-
override ReadSideEffectInstruction instr;
516-
517-
override string toString() { result = "Argument " + instr.getIndex() + " indirection" }
518-
}
519-
520508
/**
521509
* A `Node` corresponding to a variable in the program, as opposed to the
522510
* value of that variable at some particular point. This can be used for
@@ -680,10 +668,6 @@ private predicate simpleInstructionLocalFlowStep(Operand opFrom, Instruction iTo
680668
or
681669
iTo.(PhiInstruction).getAnInputOperand() = opFrom
682670
or
683-
// A read side effect is almost never exact since we don't know exactly how
684-
// much memory the callee will read.
685-
iTo.(ReadSideEffectInstruction).getSideEffectOperand() = opFrom
686-
or
687671
// Treat all conversions as flow, even conversions between different numeric types.
688672
iTo.(ConvertInstruction).getUnaryOperand() = opFrom
689673
or

‎cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected‎

Lines changed: 42 additions & 114 deletions
Large diffs are not rendered by default.

‎cpp/ql/test/library-tests/dataflow/taint-tests/IRTaintTestCommon.qll‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,10 @@ class TestAllocationConfig extends TaintTracking::Configuration {
2525
sink.(DataFlow::ExprNode).getConvertedExpr() instanceof ReferenceDereferenceExpr
2626
)
2727
or
28-
sink
29-
.asInstruction()
30-
.(ReadSideEffectInstruction)
31-
.getPrimaryInstruction()
32-
.(CallInstruction)
33-
.getStaticCallTarget()
34-
.hasName("sink")
28+
exists(ReadSideEffectInstruction read |
29+
read.getSideEffectOperand() = sink.asOperand() and
30+
read.getPrimaryInstruction().(CallInstruction).getStaticCallTarget().hasName("sink")
31+
)
3532
}
3633

3734
override predicate isSanitizer(DataFlow::Node barrier) {

‎cpp/ql/test/query-tests/Security/CWE/CWE-079/semmle/CgiXss/CgiXss.expected‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,10 @@ edges
44
| search.c:14:24:14:28 | query | search.c:17:8:17:12 | query |
55
| search.c:22:24:22:28 | query | search.c:23:39:23:43 | query |
66
| search.c:22:24:22:28 | query | search.c:23:39:23:43 | query |
7-
| search.c:41:21:41:26 | call to getenv | search.c:45:17:45:25 | raw_query |
8-
| search.c:41:21:41:26 | call to getenv | search.c:45:17:45:25 | raw_query |
9-
| search.c:41:21:41:26 | call to getenv | search.c:47:17:47:25 | raw_query |
10-
| search.c:41:21:41:26 | call to getenv | search.c:47:17:47:25 | raw_query |
11-
| search.c:45:17:45:25 | raw_query | search.c:14:24:14:28 | query |
12-
| search.c:47:17:47:25 | raw_query | search.c:22:24:22:28 | query |
7+
| search.c:41:21:41:26 | call to getenv | search.c:14:24:14:28 | query |
8+
| search.c:41:21:41:26 | call to getenv | search.c:14:24:14:28 | query |
9+
| search.c:41:21:41:26 | call to getenv | search.c:22:24:22:28 | query |
10+
| search.c:41:21:41:26 | call to getenv | search.c:22:24:22:28 | query |
1311
nodes
1412
| search.c:14:24:14:28 | query | semmle.label | query |
1513
| search.c:17:8:17:12 | (const char *)... | semmle.label | (const char *)... |
@@ -23,8 +21,8 @@ nodes
2321
| search.c:23:39:23:43 | query | semmle.label | query |
2422
| search.c:41:21:41:26 | call to getenv | semmle.label | call to getenv |
2523
| search.c:41:21:41:26 | call to getenv | semmle.label | call to getenv |
26-
| search.c:45:17:45:25 | raw_query | semmle.label | raw_query |
27-
| search.c:47:17:47:25 | raw_query | semmle.label | raw_query |
24+
| search.c:45:5:45:15 | Argument 0 | semmle.label | Argument 0 |
25+
| search.c:47:5:47:15 | Argument 0 | semmle.label | Argument 0 |
2826
#select
2927
| search.c:17:8:17:12 | query | search.c:41:21:41:26 | call to getenv | search.c:17:8:17:12 | query | Cross-site scripting vulnerability due to $@. | search.c:41:21:41:26 | call to getenv | this query data |
3028
| search.c:23:39:23:43 | query | search.c:41:21:41:26 | call to getenv | search.c:23:39:23:43 | query | Cross-site scripting vulnerability due to $@. | search.c:41:21:41:26 | call to getenv | this query data |

‎cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/UncontrolledProcessOperation.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,10 @@ nodes
3232
| test.cpp:31:10:31:16 | command | semmle.label | command |
3333
| test.cpp:31:10:31:16 | command | semmle.label | command |
3434
| test.cpp:31:10:31:16 | command | semmle.label | command |
35+
| test.cpp:42:7:42:16 | Argument 0 | semmle.label | Argument 0 |
3536
| test.cpp:42:18:42:23 | call to getenv | semmle.label | call to getenv |
3637
| test.cpp:42:18:42:34 | (const char *)... | semmle.label | (const char *)... |
38+
| test.cpp:43:7:43:16 | Argument 0 | semmle.label | Argument 0 |
3739
| test.cpp:43:18:43:23 | call to getenv | semmle.label | call to getenv |
3840
| test.cpp:43:18:43:34 | (const char *)... | semmle.label | (const char *)... |
3941
| test.cpp:56:12:56:17 | buffer | semmle.label | buffer |

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected‎

Lines changed: 10 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -65,26 +65,22 @@ edges
6565
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | (const char *)... |
6666
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | i3 |
6767
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:116:9:116:10 | i3 |
68-
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | Argument 0 indirection |
69-
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | Argument 0 indirection |
70-
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | array to pointer conversion |
71-
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | array to pointer conversion |
7268
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | array to pointer conversion |
7369
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | array to pointer conversion |
7470
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | i3 |
7571
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | i3 |
72+
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | printWrapper output argument |
73+
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:117:15:117:16 | printWrapper output argument |
7674
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | (const char *)... |
7775
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | (const char *)... |
7876
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | i4 |
7977
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:121:9:121:10 | i4 |
80-
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | Argument 0 indirection |
81-
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | Argument 0 indirection |
82-
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 |
83-
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 |
8478
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 |
8579
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 |
8680
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 |
8781
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | i4 |
82+
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | printWrapper output argument |
83+
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:122:15:122:16 | printWrapper output argument |
8884
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | (const char *)... |
8985
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | (const char *)... |
9086
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:135:9:135:12 | ... ++ |
@@ -93,20 +89,15 @@ edges
9389
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
9490
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
9591
| argvLocal.c:115:13:115:16 | argv | argvLocal.c:136:15:136:18 | -- ... |
96-
| argvLocal.c:117:15:117:16 | Argument 0 indirection | argvLocal.c:117:15:117:16 | printWrapper output argument |
97-
| argvLocal.c:117:15:117:16 | array to pointer conversion | argvLocal.c:117:15:117:16 | printWrapper output argument |
9892
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:121:9:121:10 | (const char *)... |
9993
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:121:9:121:10 | i4 |
100-
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | Argument 0 indirection |
101-
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | i4 |
10294
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | i4 |
10395
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | i4 |
96+
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:122:15:122:16 | printWrapper output argument |
10497
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | (const char *)... |
10598
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | ... ++ |
10699
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... |
107100
| argvLocal.c:117:15:117:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... |
108-
| argvLocal.c:122:15:122:16 | Argument 0 indirection | argvLocal.c:122:15:122:16 | printWrapper output argument |
109-
| argvLocal.c:122:15:122:16 | i4 | argvLocal.c:122:15:122:16 | printWrapper output argument |
110101
| argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | (const char *)... |
111102
| argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:135:9:135:12 | ... ++ |
112103
| argvLocal.c:122:15:122:16 | printWrapper output argument | argvLocal.c:136:15:136:18 | -- ... |
@@ -115,14 +106,12 @@ edges
115106
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | (const char *)... |
116107
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 |
117108
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 |
118-
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | Argument 0 indirection |
119-
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | Argument 0 indirection |
120-
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
121-
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
122109
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
123110
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
124111
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 |
125112
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 |
113+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | printWrapper output argument |
114+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | printWrapper output argument |
126115
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | (const char *)... |
127116
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | (const char *)... |
128117
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | ... + ... |
@@ -131,8 +120,6 @@ edges
131120
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
132121
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
133122
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
134-
| argvLocal.c:128:15:128:16 | Argument 0 indirection | argvLocal.c:128:15:128:16 | printWrapper output argument |
135-
| argvLocal.c:128:15:128:16 | array to pointer conversion | argvLocal.c:128:15:128:16 | printWrapper output argument |
136123
| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:131:9:131:14 | (const char *)... |
137124
| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:131:9:131:14 | ... + ... |
138125
| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:132:15:132:20 | ... + ... |
@@ -227,6 +214,7 @@ nodes
227214
| argvLocal.c:116:9:116:10 | (const char *)... | semmle.label | (const char *)... |
228215
| argvLocal.c:116:9:116:10 | (const char *)... | semmle.label | (const char *)... |
229216
| argvLocal.c:116:9:116:10 | i3 | semmle.label | i3 |
217+
| argvLocal.c:117:2:117:13 | Argument 0 | semmle.label | Argument 0 |
230218
| argvLocal.c:117:15:117:16 | Argument 0 indirection | semmle.label | Argument 0 indirection |
231219
| argvLocal.c:117:15:117:16 | array to pointer conversion | semmle.label | array to pointer conversion |
232220
| argvLocal.c:117:15:117:16 | array to pointer conversion | semmle.label | array to pointer conversion |
@@ -235,6 +223,7 @@ nodes
235223
| argvLocal.c:121:9:121:10 | (const char *)... | semmle.label | (const char *)... |
236224
| argvLocal.c:121:9:121:10 | (const char *)... | semmle.label | (const char *)... |
237225
| argvLocal.c:121:9:121:10 | i4 | semmle.label | i4 |
226+
| argvLocal.c:122:2:122:13 | Argument 0 | semmle.label | Argument 0 |
238227
| argvLocal.c:122:15:122:16 | Argument 0 indirection | semmle.label | Argument 0 indirection |
239228
| argvLocal.c:122:15:122:16 | i4 | semmle.label | i4 |
240229
| argvLocal.c:122:15:122:16 | i4 | semmle.label | i4 |
@@ -245,6 +234,7 @@ nodes
245234
| argvLocal.c:127:9:127:10 | (const char *)... | semmle.label | (const char *)... |
246235
| argvLocal.c:127:9:127:10 | (const char *)... | semmle.label | (const char *)... |
247236
| argvLocal.c:127:9:127:10 | i5 | semmle.label | i5 |
237+
| argvLocal.c:128:2:128:13 | Argument 0 | semmle.label | Argument 0 |
248238
| argvLocal.c:128:15:128:16 | Argument 0 indirection | semmle.label | Argument 0 indirection |
249239
| argvLocal.c:128:15:128:16 | array to pointer conversion | semmle.label | array to pointer conversion |
250240
| argvLocal.c:128:15:128:16 | array to pointer conversion | semmle.label | array to pointer conversion |

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/globalVars/UncontrolledFormatStringThroughGlobalVar.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ nodes
3636
| globalVars.c:12:2:12:15 | Store | semmle.label | Store |
3737
| globalVars.c:15:21:15:23 | val | semmle.label | val |
3838
| globalVars.c:16:2:16:12 | Store | semmle.label | Store |
39+
| globalVars.c:24:2:24:9 | Argument 0 | semmle.label | Argument 0 |
3940
| globalVars.c:24:11:24:14 | argv | semmle.label | argv |
4041
| globalVars.c:24:11:24:14 | argv | semmle.label | argv |
4142
| globalVars.c:27:9:27:12 | (const char *)... | semmle.label | (const char *)... |
@@ -46,6 +47,7 @@ nodes
4647
| globalVars.c:30:15:30:18 | copy | semmle.label | copy |
4748
| globalVars.c:30:15:30:18 | copy | semmle.label | copy |
4849
| globalVars.c:30:15:30:18 | copy | semmle.label | copy |
50+
| globalVars.c:35:2:35:9 | Argument 0 | semmle.label | Argument 0 |
4951
| globalVars.c:35:11:35:14 | copy | semmle.label | copy |
5052
| globalVars.c:38:9:38:13 | (const char *)... | semmle.label | (const char *)... |
5153
| globalVars.c:38:9:38:13 | (const char *)... | semmle.label | (const char *)... |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -47,18 +47,16 @@ edges
4747
| test.cpp:214:23:214:23 | s | test.cpp:215:21:215:21 | s |
4848
| test.cpp:220:21:220:21 | s | test.cpp:221:21:221:21 | s |
4949
| test.cpp:220:21:220:21 | s | test.cpp:221:21:221:21 | s |
50+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:214:23:214:23 | s |
51+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:220:21:220:21 | s |
5052
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | (size_t)... |
5153
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
5254
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
53-
| test.cpp:227:24:227:29 | call to getenv | test.cpp:235:11:235:20 | (size_t)... |
54-
| test.cpp:227:24:227:29 | call to getenv | test.cpp:237:10:237:19 | (size_t)... |
55+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:214:23:214:23 | s |
56+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:220:21:220:21 | s |
5557
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | (size_t)... |
5658
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
5759
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
58-
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:235:11:235:20 | (size_t)... |
59-
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:237:10:237:19 | (size_t)... |
60-
| test.cpp:235:11:235:20 | (size_t)... | test.cpp:214:23:214:23 | s |
61-
| test.cpp:237:10:237:19 | (size_t)... | test.cpp:220:21:220:21 | s |
6260
| test.cpp:241:2:241:32 | Chi [array content] | test.cpp:279:17:279:20 | get_size output argument [array content] |
6361
| test.cpp:241:2:241:32 | Chi [array content] | test.cpp:295:18:295:21 | get_size output argument [array content] |
6462
| test.cpp:241:2:241:32 | Store | test.cpp:241:2:241:32 | Chi [array content] |
@@ -143,8 +141,8 @@ nodes
143141
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
144142
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
145143
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
146-
| test.cpp:235:11:235:20 | (size_t)... | semmle.label | (size_t)... |
147-
| test.cpp:237:10:237:19 | (size_t)... | semmle.label | (size_t)... |
144+
| test.cpp:235:2:235:9 | Argument 0 | semmle.label | Argument 0 |
145+
| test.cpp:237:2:237:8 | Argument 0 | semmle.label | Argument 0 |
148146
| test.cpp:241:2:241:32 | Chi [array content] | semmle.label | Chi [array content] |
149147
| test.cpp:241:2:241:32 | Store | semmle.label | Store |
150148
| test.cpp:241:18:241:23 | call to getenv | semmle.label | call to getenv |

0 commit comments

Comments
 (0)