Skip to content

Commit a1b59e2

Browse files
MathiasVPMathiasVP
authored
Merge pull request #4538 from geoffw0/taintbug
C++: Add taint test for memcpy-ing into a vector
2 parents 90c027f + ceea947 commit a1b59e2

File tree

6 files changed

+94
-1
lines changed

6 files changed

+94
-1
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7038,3 +7038,52 @@
70387038
| vector.cpp:399:33:399:35 | i11 [post update] | vector.cpp:400:7:400:9 | v11 | |
70397039
| vector.cpp:399:33:399:35 | i11 [post update] | vector.cpp:401:1:401:1 | v11 | |
70407040
| vector.cpp:400:7:400:9 | ref arg v11 | vector.cpp:401:1:401:1 | v11 | |
7041+
| vector.cpp:416:22:416:25 | call to vector | vector.cpp:420:8:420:8 | v | |
7042+
| vector.cpp:416:22:416:25 | call to vector | vector.cpp:421:11:421:11 | v | |
7043+
| vector.cpp:416:22:416:25 | call to vector | vector.cpp:422:8:422:8 | v | |
7044+
| vector.cpp:416:22:416:25 | call to vector | vector.cpp:423:2:423:2 | v | |
7045+
| vector.cpp:417:11:417:16 | call to source | vector.cpp:421:18:421:18 | s | |
7046+
| vector.cpp:418:10:418:11 | 0 | vector.cpp:421:13:421:13 | i | |
7047+
| vector.cpp:420:8:420:8 | ref arg v | vector.cpp:421:11:421:11 | v | |
7048+
| vector.cpp:420:8:420:8 | ref arg v | vector.cpp:422:8:422:8 | v | |
7049+
| vector.cpp:420:8:420:8 | ref arg v | vector.cpp:423:2:423:2 | v | |
7050+
| vector.cpp:421:10:421:14 | & ... | vector.cpp:421:3:421:8 | call to memcpy | |
7051+
| vector.cpp:421:10:421:14 | ref arg & ... | vector.cpp:421:12:421:12 | call to operator[] [inner post update] | |
7052+
| vector.cpp:421:11:421:11 | ref arg v | vector.cpp:422:8:422:8 | v | |
7053+
| vector.cpp:421:11:421:11 | ref arg v | vector.cpp:423:2:423:2 | v | |
7054+
| vector.cpp:421:11:421:11 | v | vector.cpp:421:12:421:12 | call to operator[] | TAINT |
7055+
| vector.cpp:421:12:421:12 | call to operator[] | vector.cpp:421:10:421:14 | & ... | |
7056+
| vector.cpp:421:12:421:12 | call to operator[] [inner post update] | vector.cpp:421:11:421:11 | ref arg v | TAINT |
7057+
| vector.cpp:421:17:421:18 | & ... | vector.cpp:421:3:421:8 | call to memcpy | TAINT |
7058+
| vector.cpp:421:17:421:18 | & ... | vector.cpp:421:10:421:14 | ref arg & ... | TAINT |
7059+
| vector.cpp:421:18:421:18 | s | vector.cpp:421:10:421:14 | ref arg & ... | |
7060+
| vector.cpp:421:18:421:18 | s | vector.cpp:421:17:421:18 | & ... | |
7061+
| vector.cpp:422:8:422:8 | ref arg v | vector.cpp:423:2:423:2 | v | |
7062+
| vector.cpp:426:24:426:27 | call to vector | vector.cpp:432:8:432:9 | cs | |
7063+
| vector.cpp:426:24:426:27 | call to vector | vector.cpp:433:11:433:12 | cs | |
7064+
| vector.cpp:426:24:426:27 | call to vector | vector.cpp:435:8:435:9 | cs | |
7065+
| vector.cpp:426:24:426:27 | call to vector | vector.cpp:436:2:436:2 | cs | |
7066+
| vector.cpp:427:21:427:37 | call to source | vector.cpp:429:22:429:24 | src | |
7067+
| vector.cpp:427:21:427:37 | call to source | vector.cpp:431:8:431:10 | src | |
7068+
| vector.cpp:427:21:427:37 | call to source | vector.cpp:433:25:433:27 | src | |
7069+
| vector.cpp:427:21:427:37 | call to source | vector.cpp:434:8:434:10 | src | |
7070+
| vector.cpp:428:23:428:24 | 10 | vector.cpp:433:14:433:17 | offs | |
7071+
| vector.cpp:429:26:429:31 | call to length | vector.cpp:433:38:433:40 | len | |
7072+
| vector.cpp:431:8:431:10 | ref arg src | vector.cpp:433:25:433:27 | src | |
7073+
| vector.cpp:431:8:431:10 | ref arg src | vector.cpp:434:8:434:10 | src | |
7074+
| vector.cpp:432:8:432:9 | ref arg cs | vector.cpp:433:11:433:12 | cs | |
7075+
| vector.cpp:432:8:432:9 | ref arg cs | vector.cpp:435:8:435:9 | cs | |
7076+
| vector.cpp:432:8:432:9 | ref arg cs | vector.cpp:436:2:436:2 | cs | |
7077+
| vector.cpp:433:10:433:22 | & ... | vector.cpp:433:3:433:8 | call to memcpy | |
7078+
| vector.cpp:433:10:433:22 | ref arg & ... | vector.cpp:433:13:433:13 | call to operator[] [inner post update] | |
7079+
| vector.cpp:433:11:433:12 | cs | vector.cpp:433:13:433:13 | call to operator[] | TAINT |
7080+
| vector.cpp:433:11:433:12 | ref arg cs | vector.cpp:435:8:435:9 | cs | |
7081+
| vector.cpp:433:11:433:12 | ref arg cs | vector.cpp:436:2:436:2 | cs | |
7082+
| vector.cpp:433:13:433:13 | call to operator[] | vector.cpp:433:10:433:22 | & ... | |
7083+
| vector.cpp:433:13:433:13 | call to operator[] [inner post update] | vector.cpp:433:11:433:12 | ref arg cs | TAINT |
7084+
| vector.cpp:433:14:433:17 | offs | vector.cpp:433:14:433:21 | ... + ... | TAINT |
7085+
| vector.cpp:433:21:433:21 | 1 | vector.cpp:433:14:433:21 | ... + ... | TAINT |
7086+
| vector.cpp:433:25:433:27 | src | vector.cpp:433:29:433:33 | call to c_str | TAINT |
7087+
| vector.cpp:433:29:433:33 | call to c_str | vector.cpp:433:3:433:8 | call to memcpy | TAINT |
7088+
| vector.cpp:433:29:433:33 | call to c_str | vector.cpp:433:10:433:22 | ref arg & ... | TAINT |
7089+
| vector.cpp:435:8:435:9 | ref arg cs | vector.cpp:436:2:436:2 | cs | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ void *memcpy(void *dest, void *src, int len);
192192
void test_memcpy(int *source) {
193193
int x;
194194
memcpy(&x, source, sizeof(int));
195-
sink(x);
195+
sink(x); // tainted
196196
}
197197

198198
// --- std::swap ---

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -653,3 +653,7 @@
653653
| vector.cpp:392:7:392:8 | v9 | vector.cpp:330:10:330:15 | call to source |
654654
| vector.cpp:392:7:392:8 | v9 | vector.cpp:389:8:389:13 | call to source |
655655
| vector.cpp:400:7:400:9 | v11 | vector.cpp:399:38:399:43 | call to source |
656+
| vector.cpp:422:8:422:8 | v | vector.cpp:417:11:417:16 | call to source |
657+
| vector.cpp:431:8:431:10 | src | vector.cpp:427:21:427:37 | call to source |
658+
| vector.cpp:434:8:434:10 | src | vector.cpp:427:21:427:37 | call to source |
659+
| vector.cpp:435:8:435:9 | cs | vector.cpp:427:21:427:37 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -379,3 +379,5 @@
379379
| vector.cpp:392:7:392:8 | vector.cpp:330:10:330:15 | AST only |
380380
| vector.cpp:392:7:392:8 | vector.cpp:389:8:389:13 | AST only |
381381
| vector.cpp:400:7:400:9 | vector.cpp:399:38:399:43 | AST only |
382+
| vector.cpp:422:8:422:8 | vector.cpp:417:11:417:16 | AST only |
383+
| vector.cpp:435:8:435:9 | vector.cpp:427:21:427:37 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,3 +416,5 @@
416416
| vector.cpp:312:7:312:7 | Argument 0 indirection | vector.cpp:303:14:303:19 | call to source |
417417
| vector.cpp:324:7:324:8 | Argument 0 indirection | vector.cpp:318:15:318:20 | call to source |
418418
| vector.cpp:326:7:326:8 | Argument 0 indirection | vector.cpp:318:15:318:20 | call to source |
419+
| vector.cpp:431:8:431:10 | Argument 0 indirection | vector.cpp:427:21:427:37 | call to source |
420+
| vector.cpp:434:8:434:10 | Argument 0 indirection | vector.cpp:427:21:427:37 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,3 +399,39 @@ void test_vector_output_iterator(int b) {
399399
vector_iterator_assign_wrapper(i11, source());
400400
sink(v11); // tainted [NOT DETECTED by IR]
401401
}
402+
403+
void *memcpy(void *s1, const void *s2, size_t n);
404+
405+
namespace ns_string
406+
{
407+
std::string source();
408+
}
409+
410+
void sink(std::vector<char> &);
411+
void sink(std::string &);
412+
413+
void test_vector_memcpy()
414+
{
415+
{
416+
std::vector<int> v(100);
417+
int s = source();
418+
int i = 0;
419+
420+
sink(v);
421+
memcpy(&v[i], &s, sizeof(int));
422+
sink(v); // tainted [NOT DETECTED by IR]
423+
}
424+
425+
{
426+
std::vector<char> cs(100);
427+
std::string src = ns_string::source();
428+
const size_t offs = 10;
429+
const size_t len = src.length();
430+
431+
sink(src); // tainted
432+
sink(cs);
433+
memcpy(&cs[offs + 1], src.c_str(), len);
434+
sink(src); // tainted
435+
sink(cs); // tainted [NOT DETECTED by IR]
436+
}
437+
}

0 commit comments

Comments
 (0)