Skip to content

Commit f908d2f

Browse files
MathiasVPMathiasVP
committed
C++: Remove hasTaintFlow from poll and select functions.
1 parent 576a872 commit f908d2f

File tree

4 files changed

+2
-101
lines changed

4 files changed

+2
-101
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/Poll.qll‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,13 @@
55

66
import semmle.code.cpp.Function
77
import semmle.code.cpp.models.interfaces.ArrayFunction
8-
import semmle.code.cpp.models.interfaces.Taint
98
import semmle.code.cpp.models.interfaces.Alias
109
import semmle.code.cpp.models.interfaces.SideEffect
1110

1211
/**
1312
* The function `poll` and its assorted variants
1413
*/
15-
private class Poll extends ArrayFunction, AliasFunction, TaintFunction, SideEffectFunction {
14+
private class Poll extends ArrayFunction, AliasFunction, SideEffectFunction {
1615
Poll() { this.hasGlobalName(["poll", "ppoll", "WSAPoll"]) }
1716

1817
override predicate hasArrayWithVariableSize(int bufParam, int countParam) {
@@ -29,11 +28,6 @@ private class Poll extends ArrayFunction, AliasFunction, TaintFunction, SideEffe
2928

3029
override predicate parameterIsAlwaysReturned(int index) { none() }
3130

32-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
33-
input.isParameterDeref(0) and
34-
output.isParameterDeref(0)
35-
}
36-
3731
override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
3832
i = 0 and buffer = true and mustWrite = false
3933
}

‎cpp/ql/src/semmle/code/cpp/models/implementations/Select.qll‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,13 @@
55

66
import semmle.code.cpp.Function
77
import semmle.code.cpp.models.interfaces.ArrayFunction
8-
import semmle.code.cpp.models.interfaces.Taint
98
import semmle.code.cpp.models.interfaces.Alias
109
import semmle.code.cpp.models.interfaces.SideEffect
1110

1211
/**
1312
* The function `select` and its assorted variants
1413
*/
15-
private class Select extends ArrayFunction, AliasFunction, TaintFunction, SideEffectFunction {
14+
private class Select extends ArrayFunction, AliasFunction, SideEffectFunction {
1615
Select() { this.hasGlobalName(["select", "pselect"]) }
1716

1817
override predicate hasArrayWithUnknownSize(int bufParam) { bufParam = [1 .. 3] }
@@ -27,13 +26,6 @@ private class Select extends ArrayFunction, AliasFunction, TaintFunction, SideEf
2726

2827
override predicate parameterIsAlwaysReturned(int index) { none() }
2928

30-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
31-
exists(int i | i = [1 .. 3] |
32-
input.isParameterDeref(i) and
33-
output.isParameterDeref(i)
34-
)
35-
}
36-
3729
override predicate hasSpecificWriteSideEffect(ParameterIndex i, boolean buffer, boolean mustWrite) {
3830
i = [1 .. 3] and buffer = true and mustWrite = false
3931
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/bsd.cpp‎

Lines changed: 0 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -22,43 +22,3 @@ void test_accept() {
2222
sink(a); // $ ast=17:11 SPURIOUS: ast=18:12 MISSING: ir
2323
sink(addr); // $ ast MISSING: ir
2424
}
25-
26-
// --- poll ---
27-
28-
struct pollfd {
29-
int fd;
30-
short events;
31-
short revents;
32-
};
33-
34-
int poll(struct pollfd *, int, int);
35-
36-
void test_poll() {
37-
pollfd pfds;
38-
39-
pfds.events = 1;
40-
pfds.fd = source();
41-
poll(&pfds, 1, -1);
42-
43-
sink(pfds); // $ ast MISSING: ir
44-
}
45-
46-
// --- select ---
47-
48-
typedef struct {} timeval;
49-
50-
typedef struct fd_set {
51-
int fd_count;
52-
int fd_array[4096];
53-
} fd_set;
54-
55-
int select(int, fd_set *, fd_set *, fd_set *, timeval *);
56-
57-
void test_select(timeval timeout) {
58-
fd_set readfds;
59-
60-
readfds.fd_count = 1;
61-
readfds.fd_array[0] = source();
62-
select(2, &readfds, nullptr, nullptr, &timeout);
63-
sink(&readfds); // $ ast MISSING: ir
64-
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 0 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -146,51 +146,6 @@
146146
| bsd.cpp:20:22:20:25 | addr | bsd.cpp:20:21:20:25 | & ... | |
147147
| bsd.cpp:20:28:20:32 | ref arg & ... | bsd.cpp:20:29:20:32 | size [inner post update] | |
148148
| bsd.cpp:20:29:20:32 | size | bsd.cpp:20:28:20:32 | & ... | |
149-
| bsd.cpp:37:10:37:13 | pfds | bsd.cpp:39:3:39:6 | pfds | |
150-
| bsd.cpp:37:10:37:13 | pfds | bsd.cpp:40:3:40:6 | pfds | |
151-
| bsd.cpp:37:10:37:13 | pfds | bsd.cpp:41:9:41:12 | pfds | |
152-
| bsd.cpp:37:10:37:13 | pfds | bsd.cpp:43:8:43:11 | pfds | |
153-
| bsd.cpp:39:3:39:6 | pfds [post update] | bsd.cpp:40:3:40:6 | pfds | |
154-
| bsd.cpp:39:3:39:6 | pfds [post update] | bsd.cpp:41:9:41:12 | pfds | |
155-
| bsd.cpp:39:3:39:6 | pfds [post update] | bsd.cpp:43:8:43:11 | pfds | |
156-
| bsd.cpp:39:3:39:17 | ... = ... | bsd.cpp:39:8:39:13 | events [post update] | |
157-
| bsd.cpp:39:17:39:17 | 1 | bsd.cpp:39:3:39:17 | ... = ... | |
158-
| bsd.cpp:40:3:40:6 | pfds [post update] | bsd.cpp:41:9:41:12 | pfds | |
159-
| bsd.cpp:40:3:40:6 | pfds [post update] | bsd.cpp:43:8:43:11 | pfds | |
160-
| bsd.cpp:40:3:40:20 | ... = ... | bsd.cpp:40:8:40:9 | fd [post update] | |
161-
| bsd.cpp:40:13:40:18 | call to source | bsd.cpp:40:3:40:20 | ... = ... | |
162-
| bsd.cpp:41:8:41:12 | & ... | bsd.cpp:41:8:41:12 | ref arg & ... | TAINT |
163-
| bsd.cpp:41:8:41:12 | ref arg & ... | bsd.cpp:41:9:41:12 | pfds [inner post update] | |
164-
| bsd.cpp:41:8:41:12 | ref arg & ... | bsd.cpp:43:8:43:11 | pfds | |
165-
| bsd.cpp:41:9:41:12 | pfds | bsd.cpp:41:8:41:12 | & ... | |
166-
| bsd.cpp:41:9:41:12 | pfds | bsd.cpp:41:8:41:12 | ref arg & ... | TAINT |
167-
| bsd.cpp:41:19:41:19 | 1 | bsd.cpp:41:18:41:19 | - ... | TAINT |
168-
| bsd.cpp:57:26:57:32 | timeout | bsd.cpp:62:42:62:48 | timeout | |
169-
| bsd.cpp:58:10:58:16 | readfds | bsd.cpp:60:3:60:9 | readfds | |
170-
| bsd.cpp:58:10:58:16 | readfds | bsd.cpp:61:3:61:9 | readfds | |
171-
| bsd.cpp:58:10:58:16 | readfds | bsd.cpp:62:14:62:20 | readfds | |
172-
| bsd.cpp:58:10:58:16 | readfds | bsd.cpp:63:9:63:15 | readfds | |
173-
| bsd.cpp:60:3:60:9 | readfds [post update] | bsd.cpp:61:3:61:9 | readfds | |
174-
| bsd.cpp:60:3:60:9 | readfds [post update] | bsd.cpp:62:14:62:20 | readfds | |
175-
| bsd.cpp:60:3:60:9 | readfds [post update] | bsd.cpp:63:9:63:15 | readfds | |
176-
| bsd.cpp:60:3:60:22 | ... = ... | bsd.cpp:60:11:60:18 | fd_count [post update] | |
177-
| bsd.cpp:60:22:60:22 | 1 | bsd.cpp:60:3:60:22 | ... = ... | |
178-
| bsd.cpp:61:3:61:9 | readfds [post update] | bsd.cpp:62:14:62:20 | readfds | |
179-
| bsd.cpp:61:3:61:9 | readfds [post update] | bsd.cpp:63:9:63:15 | readfds | |
180-
| bsd.cpp:61:3:61:21 | access to array [post update] | bsd.cpp:61:11:61:18 | fd_array [inner post update] | |
181-
| bsd.cpp:61:3:61:32 | ... = ... | bsd.cpp:61:3:61:21 | access to array [post update] | |
182-
| bsd.cpp:61:11:61:18 | fd_array | bsd.cpp:61:3:61:21 | access to array | |
183-
| bsd.cpp:61:20:61:20 | 0 | bsd.cpp:61:3:61:21 | access to array | TAINT |
184-
| bsd.cpp:61:25:61:30 | call to source | bsd.cpp:61:3:61:32 | ... = ... | |
185-
| bsd.cpp:62:13:62:20 | & ... | bsd.cpp:62:13:62:20 | ref arg & ... | TAINT |
186-
| bsd.cpp:62:13:62:20 | ref arg & ... | bsd.cpp:62:14:62:20 | readfds [inner post update] | |
187-
| bsd.cpp:62:13:62:20 | ref arg & ... | bsd.cpp:63:9:63:15 | readfds | |
188-
| bsd.cpp:62:14:62:20 | readfds | bsd.cpp:62:13:62:20 | & ... | |
189-
| bsd.cpp:62:14:62:20 | readfds | bsd.cpp:62:13:62:20 | ref arg & ... | TAINT |
190-
| bsd.cpp:62:41:62:48 | ref arg & ... | bsd.cpp:62:42:62:48 | timeout [inner post update] | |
191-
| bsd.cpp:62:42:62:48 | timeout | bsd.cpp:62:41:62:48 | & ... | |
192-
| bsd.cpp:63:8:63:15 | ref arg & ... | bsd.cpp:63:9:63:15 | readfds [inner post update] | |
193-
| bsd.cpp:63:9:63:15 | readfds | bsd.cpp:63:8:63:15 | & ... | |
194149
| constructor_delegation.cpp:8:2:8:8 | this | constructor_delegation.cpp:8:20:8:24 | constructor init of field x [pre-this] | |
195150
| constructor_delegation.cpp:8:14:8:15 | _x | constructor_delegation.cpp:8:22:8:23 | _x | |
196151
| constructor_delegation.cpp:8:22:8:23 | _x | constructor_delegation.cpp:8:20:8:24 | constructor init of field x | TAINT |

0 commit comments

Comments
 (0)