Skip to content

Commit ceea947

Browse files
geoffw0geoffw0
committed
C++: Add another test case.
1 parent 3cca844 commit ceea947

File tree

5 files changed

+86
-29
lines changed

5 files changed

+86
-29
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 49 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -7038,24 +7038,52 @@
70387038
| vector.cpp:399:33:399:35 | i11 [post update] | vector.cpp:400:7:400:9 | v11 | |
70397039
| vector.cpp:399:33:399:35 | i11 [post update] | vector.cpp:401:1:401:1 | v11 | |
70407040
| vector.cpp:400:7:400:9 | ref arg v11 | vector.cpp:401:1:401:1 | v11 | |
7041-
| vector.cpp:407:21:407:24 | call to vector | vector.cpp:411:7:411:7 | v | |
7042-
| vector.cpp:407:21:407:24 | call to vector | vector.cpp:412:10:412:10 | v | |
7043-
| vector.cpp:407:21:407:24 | call to vector | vector.cpp:413:7:413:7 | v | |
7044-
| vector.cpp:407:21:407:24 | call to vector | vector.cpp:414:1:414:1 | v | |
7045-
| vector.cpp:408:10:408:15 | call to source | vector.cpp:412:17:412:17 | s | |
7046-
| vector.cpp:409:9:409:10 | 0 | vector.cpp:412:12:412:12 | i | |
7047-
| vector.cpp:411:7:411:7 | ref arg v | vector.cpp:412:10:412:10 | v | |
7048-
| vector.cpp:411:7:411:7 | ref arg v | vector.cpp:413:7:413:7 | v | |
7049-
| vector.cpp:411:7:411:7 | ref arg v | vector.cpp:414:1:414:1 | v | |
7050-
| vector.cpp:412:9:412:13 | & ... | vector.cpp:412:2:412:7 | call to memcpy | |
7051-
| vector.cpp:412:9:412:13 | ref arg & ... | vector.cpp:412:11:412:11 | call to operator[] [inner post update] | |
7052-
| vector.cpp:412:10:412:10 | ref arg v | vector.cpp:413:7:413:7 | v | |
7053-
| vector.cpp:412:10:412:10 | ref arg v | vector.cpp:414:1:414:1 | v | |
7054-
| vector.cpp:412:10:412:10 | v | vector.cpp:412:11:412:11 | call to operator[] | TAINT |
7055-
| vector.cpp:412:11:412:11 | call to operator[] | vector.cpp:412:9:412:13 | & ... | |
7056-
| vector.cpp:412:11:412:11 | call to operator[] [inner post update] | vector.cpp:412:10:412:10 | ref arg v | TAINT |
7057-
| vector.cpp:412:16:412:17 | & ... | vector.cpp:412:2:412:7 | call to memcpy | TAINT |
7058-
| vector.cpp:412:16:412:17 | & ... | vector.cpp:412:9:412:13 | ref arg & ... | TAINT |
7059-
| vector.cpp:412:17:412:17 | s | vector.cpp:412:9:412:13 | ref arg & ... | |
7060-
| vector.cpp:412:17:412:17 | s | vector.cpp:412:16:412:17 | & ... | |
7061-
| vector.cpp:413:7:413:7 | ref arg v | vector.cpp:414:1:414:1 | v | |
7041+
| vector.cpp:416:22:416:25 | call to vector | vector.cpp:420:8:420:8 | v | |
7042+
| vector.cpp:416:22:416:25 | call to vector | vector.cpp:421:11:421:11 | v | |
7043+
| vector.cpp:416:22:416:25 | call to vector | vector.cpp:422:8:422:8 | v | |
7044+
| vector.cpp:416:22:416:25 | call to vector | vector.cpp:423:2:423:2 | v | |
7045+
| vector.cpp:417:11:417:16 | call to source | vector.cpp:421:18:421:18 | s | |
7046+
| vector.cpp:418:10:418:11 | 0 | vector.cpp:421:13:421:13 | i | |
7047+
| vector.cpp:420:8:420:8 | ref arg v | vector.cpp:421:11:421:11 | v | |
7048+
| vector.cpp:420:8:420:8 | ref arg v | vector.cpp:422:8:422:8 | v | |
7049+
| vector.cpp:420:8:420:8 | ref arg v | vector.cpp:423:2:423:2 | v | |
7050+
| vector.cpp:421:10:421:14 | & ... | vector.cpp:421:3:421:8 | call to memcpy | |
7051+
| vector.cpp:421:10:421:14 | ref arg & ... | vector.cpp:421:12:421:12 | call to operator[] [inner post update] | |
7052+
| vector.cpp:421:11:421:11 | ref arg v | vector.cpp:422:8:422:8 | v | |
7053+
| vector.cpp:421:11:421:11 | ref arg v | vector.cpp:423:2:423:2 | v | |
7054+
| vector.cpp:421:11:421:11 | v | vector.cpp:421:12:421:12 | call to operator[] | TAINT |
7055+
| vector.cpp:421:12:421:12 | call to operator[] | vector.cpp:421:10:421:14 | & ... | |
7056+
| vector.cpp:421:12:421:12 | call to operator[] [inner post update] | vector.cpp:421:11:421:11 | ref arg v | TAINT |
7057+
| vector.cpp:421:17:421:18 | & ... | vector.cpp:421:3:421:8 | call to memcpy | TAINT |
7058+
| vector.cpp:421:17:421:18 | & ... | vector.cpp:421:10:421:14 | ref arg & ... | TAINT |
7059+
| vector.cpp:421:18:421:18 | s | vector.cpp:421:10:421:14 | ref arg & ... | |
7060+
| vector.cpp:421:18:421:18 | s | vector.cpp:421:17:421:18 | & ... | |
7061+
| vector.cpp:422:8:422:8 | ref arg v | vector.cpp:423:2:423:2 | v | |
7062+
| vector.cpp:426:24:426:27 | call to vector | vector.cpp:432:8:432:9 | cs | |
7063+
| vector.cpp:426:24:426:27 | call to vector | vector.cpp:433:11:433:12 | cs | |
7064+
| vector.cpp:426:24:426:27 | call to vector | vector.cpp:435:8:435:9 | cs | |
7065+
| vector.cpp:426:24:426:27 | call to vector | vector.cpp:436:2:436:2 | cs | |
7066+
| vector.cpp:427:21:427:37 | call to source | vector.cpp:429:22:429:24 | src | |
7067+
| vector.cpp:427:21:427:37 | call to source | vector.cpp:431:8:431:10 | src | |
7068+
| vector.cpp:427:21:427:37 | call to source | vector.cpp:433:25:433:27 | src | |
7069+
| vector.cpp:427:21:427:37 | call to source | vector.cpp:434:8:434:10 | src | |
7070+
| vector.cpp:428:23:428:24 | 10 | vector.cpp:433:14:433:17 | offs | |
7071+
| vector.cpp:429:26:429:31 | call to length | vector.cpp:433:38:433:40 | len | |
7072+
| vector.cpp:431:8:431:10 | ref arg src | vector.cpp:433:25:433:27 | src | |
7073+
| vector.cpp:431:8:431:10 | ref arg src | vector.cpp:434:8:434:10 | src | |
7074+
| vector.cpp:432:8:432:9 | ref arg cs | vector.cpp:433:11:433:12 | cs | |
7075+
| vector.cpp:432:8:432:9 | ref arg cs | vector.cpp:435:8:435:9 | cs | |
7076+
| vector.cpp:432:8:432:9 | ref arg cs | vector.cpp:436:2:436:2 | cs | |
7077+
| vector.cpp:433:10:433:22 | & ... | vector.cpp:433:3:433:8 | call to memcpy | |
7078+
| vector.cpp:433:10:433:22 | ref arg & ... | vector.cpp:433:13:433:13 | call to operator[] [inner post update] | |
7079+
| vector.cpp:433:11:433:12 | cs | vector.cpp:433:13:433:13 | call to operator[] | TAINT |
7080+
| vector.cpp:433:11:433:12 | ref arg cs | vector.cpp:435:8:435:9 | cs | |
7081+
| vector.cpp:433:11:433:12 | ref arg cs | vector.cpp:436:2:436:2 | cs | |
7082+
| vector.cpp:433:13:433:13 | call to operator[] | vector.cpp:433:10:433:22 | & ... | |
7083+
| vector.cpp:433:13:433:13 | call to operator[] [inner post update] | vector.cpp:433:11:433:12 | ref arg cs | TAINT |
7084+
| vector.cpp:433:14:433:17 | offs | vector.cpp:433:14:433:21 | ... + ... | TAINT |
7085+
| vector.cpp:433:21:433:21 | 1 | vector.cpp:433:14:433:21 | ... + ... | TAINT |
7086+
| vector.cpp:433:25:433:27 | src | vector.cpp:433:29:433:33 | call to c_str | TAINT |
7087+
| vector.cpp:433:29:433:33 | call to c_str | vector.cpp:433:3:433:8 | call to memcpy | TAINT |
7088+
| vector.cpp:433:29:433:33 | call to c_str | vector.cpp:433:10:433:22 | ref arg & ... | TAINT |
7089+
| vector.cpp:435:8:435:9 | ref arg cs | vector.cpp:436:2:436:2 | cs | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -653,4 +653,7 @@
653653
| vector.cpp:392:7:392:8 | v9 | vector.cpp:330:10:330:15 | call to source |
654654
| vector.cpp:392:7:392:8 | v9 | vector.cpp:389:8:389:13 | call to source |
655655
| vector.cpp:400:7:400:9 | v11 | vector.cpp:399:38:399:43 | call to source |
656-
| vector.cpp:413:7:413:7 | v | vector.cpp:408:10:408:15 | call to source |
656+
| vector.cpp:422:8:422:8 | v | vector.cpp:417:11:417:16 | call to source |
657+
| vector.cpp:431:8:431:10 | src | vector.cpp:427:21:427:37 | call to source |
658+
| vector.cpp:434:8:434:10 | src | vector.cpp:427:21:427:37 | call to source |
659+
| vector.cpp:435:8:435:9 | cs | vector.cpp:427:21:427:37 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -379,4 +379,5 @@
379379
| vector.cpp:392:7:392:8 | vector.cpp:330:10:330:15 | AST only |
380380
| vector.cpp:392:7:392:8 | vector.cpp:389:8:389:13 | AST only |
381381
| vector.cpp:400:7:400:9 | vector.cpp:399:38:399:43 | AST only |
382-
| vector.cpp:413:7:413:7 | vector.cpp:408:10:408:15 | AST only |
382+
| vector.cpp:422:8:422:8 | vector.cpp:417:11:417:16 | AST only |
383+
| vector.cpp:435:8:435:9 | vector.cpp:427:21:427:37 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -416,3 +416,5 @@
416416
| vector.cpp:312:7:312:7 | Argument 0 indirection | vector.cpp:303:14:303:19 | call to source |
417417
| vector.cpp:324:7:324:8 | Argument 0 indirection | vector.cpp:318:15:318:20 | call to source |
418418
| vector.cpp:326:7:326:8 | Argument 0 indirection | vector.cpp:318:15:318:20 | call to source |
419+
| vector.cpp:431:8:431:10 | Argument 0 indirection | vector.cpp:427:21:427:37 | call to source |
420+
| vector.cpp:434:8:434:10 | Argument 0 indirection | vector.cpp:427:21:427:37 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp‎

Lines changed: 29 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -402,13 +402,36 @@ void test_vector_output_iterator(int b) {
402402

403403
void *memcpy(void *s1, const void *s2, size_t n);
404404

405+
namespace ns_string
406+
{
407+
std::string source();
408+
}
409+
410+
void sink(std::vector<char> &);
411+
void sink(std::string &);
412+
405413
void test_vector_memcpy()
406414
{
407-
std::vector<int> v(100);
408-
int s = source();
409-
int i = 0;
415+
{
416+
std::vector<int> v(100);
417+
int s = source();
418+
int i = 0;
410419

411-
sink(v);
412-
memcpy(&v[i], &s, sizeof(int));
413-
sink(v); // tainted [NOT DETECTED by IR]
420+
sink(v);
421+
memcpy(&v[i], &s, sizeof(int));
422+
sink(v); // tainted [NOT DETECTED by IR]
423+
}
424+
425+
{
426+
std::vector<char> cs(100);
427+
std::string src = ns_string::source();
428+
const size_t offs = 10;
429+
const size_t len = src.length();
430+
431+
sink(src); // tainted
432+
sink(cs);
433+
memcpy(&cs[offs + 1], src.c_str(), len);
434+
sink(src); // tainted
435+
sink(cs); // tainted [NOT DETECTED by IR]
436+
}
414437
}

0 commit comments

Comments
 (0)