Skip to content

Commit fbff44e

Browse files
geoffw0geoffw0
committed
C++: Add reverse taint as well.
1 parent 6ae96ba commit fbff44e

File tree

5 files changed

+24
-5
lines changed

5 files changed

+24
-5
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ class StdSequenceContainerData extends TaintFunction {
4343
// flow from container itself (qualifier) to return value
4444
input.isQualifierObject() and
4545
output.isReturnValueDeref()
46+
or
47+
// reverse flow from returned reference to the qualifier (for writes to
48+
// `data`)
49+
input.isReturnValueDeref() and
50+
output.isQualifierObject()
4651
}
4752
}
4853

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1868,6 +1868,7 @@
18681868
| vector.cpp:74:2:74:13 | access to array [post update] | vector.cpp:74:5:74:8 | call to data [inner post update] | |
18691869
| vector.cpp:74:2:74:24 | ... = ... | vector.cpp:74:2:74:13 | access to array [post update] | |
18701870
| vector.cpp:74:5:74:8 | call to data | vector.cpp:74:2:74:13 | access to array | TAINT |
1871+
| vector.cpp:74:5:74:8 | call to data [inner post update] | vector.cpp:74:2:74:3 | ref arg v6 | TAINT |
18711872
| vector.cpp:74:12:74:12 | 2 | vector.cpp:74:2:74:13 | access to array | TAINT |
18721873
| vector.cpp:74:17:74:22 | call to source | vector.cpp:74:2:74:24 | ... = ... | |
18731874
| vector.cpp:75:7:75:8 | ref arg v6 | vector.cpp:76:7:76:8 | v6 | |
@@ -2320,6 +2321,7 @@
23202321
| vector.cpp:256:7:256:8 | ref arg v1 | vector.cpp:257:7:257:8 | v1 | |
23212322
| vector.cpp:256:7:256:8 | ref arg v1 | vector.cpp:263:1:263:1 | v1 | |
23222323
| vector.cpp:256:7:256:8 | v1 | vector.cpp:256:10:256:13 | call to data | TAINT |
2324+
| vector.cpp:256:10:256:13 | ref arg call to data | vector.cpp:256:7:256:8 | ref arg v1 | TAINT |
23232325
| vector.cpp:257:7:257:8 | ref arg v1 | vector.cpp:263:1:263:1 | v1 | |
23242326
| vector.cpp:257:7:257:8 | v1 | vector.cpp:257:10:257:13 | call to data | TAINT |
23252327
| vector.cpp:257:10:257:13 | call to data | vector.cpp:257:7:257:18 | access to array | TAINT |
@@ -2332,13 +2334,15 @@
23322334
| vector.cpp:259:4:259:5 | ref arg v2 | vector.cpp:263:1:263:1 | v2 | |
23332335
| vector.cpp:259:4:259:5 | v2 | vector.cpp:259:7:259:10 | call to data | TAINT |
23342336
| vector.cpp:259:7:259:10 | call to data | vector.cpp:259:2:259:13 | * ... | TAINT |
2337+
| vector.cpp:259:7:259:10 | call to data [inner post update] | vector.cpp:259:4:259:5 | ref arg v2 | TAINT |
23352338
| vector.cpp:259:17:259:30 | call to source | vector.cpp:259:2:259:32 | ... = ... | |
23362339
| vector.cpp:260:7:260:8 | ref arg v2 | vector.cpp:261:7:261:8 | v2 | |
23372340
| vector.cpp:260:7:260:8 | ref arg v2 | vector.cpp:262:7:262:8 | v2 | |
23382341
| vector.cpp:260:7:260:8 | ref arg v2 | vector.cpp:263:1:263:1 | v2 | |
23392342
| vector.cpp:261:7:261:8 | ref arg v2 | vector.cpp:262:7:262:8 | v2 | |
23402343
| vector.cpp:261:7:261:8 | ref arg v2 | vector.cpp:263:1:263:1 | v2 | |
23412344
| vector.cpp:261:7:261:8 | v2 | vector.cpp:261:10:261:13 | call to data | TAINT |
2345+
| vector.cpp:261:10:261:13 | ref arg call to data | vector.cpp:261:7:261:8 | ref arg v2 | TAINT |
23422346
| vector.cpp:262:7:262:8 | ref arg v2 | vector.cpp:263:1:263:1 | v2 | |
23432347
| vector.cpp:262:7:262:8 | v2 | vector.cpp:262:10:262:13 | call to data | TAINT |
23442348
| vector.cpp:262:10:262:13 | call to data | vector.cpp:262:7:262:18 | access to array | TAINT |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,8 @@
218218
| vector.cpp:70:7:70:8 | v5 | vector.cpp:69:15:69:20 | call to source |
219219
| vector.cpp:71:10:71:14 | call to front | vector.cpp:69:15:69:20 | call to source |
220220
| vector.cpp:72:10:72:13 | call to back | vector.cpp:69:15:69:20 | call to source |
221+
| vector.cpp:75:7:75:8 | v6 | vector.cpp:74:17:74:22 | call to source |
222+
| vector.cpp:76:7:76:18 | access to array | vector.cpp:74:17:74:22 | call to source |
221223
| vector.cpp:97:7:97:8 | v9 | vector.cpp:96:13:96:18 | call to source |
222224
| vector.cpp:98:10:98:11 | call to at | vector.cpp:96:13:96:18 | call to source |
223225
| vector.cpp:99:10:99:11 | call to at | vector.cpp:96:13:96:18 | call to source |
@@ -241,3 +243,6 @@
241243
| vector.cpp:255:7:255:8 | v1 | vector.cpp:254:15:254:20 | call to source |
242244
| vector.cpp:256:10:256:13 | call to data | vector.cpp:254:15:254:20 | call to source |
243245
| vector.cpp:257:7:257:18 | access to array | vector.cpp:254:15:254:20 | call to source |
246+
| vector.cpp:260:7:260:8 | v2 | vector.cpp:259:17:259:30 | call to source |
247+
| vector.cpp:261:10:261:13 | call to data | vector.cpp:259:17:259:30 | call to source |
248+
| vector.cpp:262:7:262:18 | access to array | vector.cpp:259:17:259:30 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,8 @@
153153
| vector.cpp:70:7:70:8 | vector.cpp:69:15:69:20 | AST only |
154154
| vector.cpp:71:10:71:14 | vector.cpp:69:15:69:20 | AST only |
155155
| vector.cpp:72:10:72:13 | vector.cpp:69:15:69:20 | AST only |
156+
| vector.cpp:75:7:75:8 | vector.cpp:74:17:74:22 | AST only |
157+
| vector.cpp:76:7:76:18 | vector.cpp:74:17:74:22 | AST only |
156158
| vector.cpp:97:7:97:8 | vector.cpp:96:13:96:18 | AST only |
157159
| vector.cpp:98:10:98:11 | vector.cpp:96:13:96:18 | AST only |
158160
| vector.cpp:99:10:99:11 | vector.cpp:96:13:96:18 | AST only |
@@ -177,3 +179,6 @@
177179
| vector.cpp:255:7:255:8 | vector.cpp:254:15:254:20 | AST only |
178180
| vector.cpp:256:10:256:13 | vector.cpp:254:15:254:20 | AST only |
179181
| vector.cpp:257:7:257:18 | vector.cpp:254:15:254:20 | AST only |
182+
| vector.cpp:260:7:260:8 | vector.cpp:259:17:259:30 | AST only |
183+
| vector.cpp:261:10:261:13 | vector.cpp:259:17:259:30 | AST only |
184+
| vector.cpp:262:7:262:18 | vector.cpp:259:17:259:30 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,8 @@ void test_element_taint(int x) {
7272
sink(v5.back()); // tainted
7373

7474
v6.data()[2] = source();
75-
sink(v6); // tainted [NOT DETECTED]
76-
sink(v6.data()[2]); // tainted [NOT DETECTED]
75+
sink(v6); // tainted
76+
sink(v6.data()[2]); // tainted
7777

7878
{
7979
const std::vector<int> &v7c = v7; // (workaround because our iterators don't convert to const_iterator)
@@ -257,7 +257,7 @@ void test_data_more() {
257257
sink(v1.data()[2]); // tainted
258258

259259
*(v2.data()) = ns_int::source();
260-
sink(v2); // tainted [NOT DETECTED]
261-
sink(v2.data()); // tainted [NOT DETECTED]
262-
sink(v2.data()[2]); // tainted [NOT DETECTED]
260+
sink(v2); // tainted
261+
sink(v2.data()); // tainted
262+
sink(v2.data()[2]); // tainted
263263
}

0 commit comments

Comments
 (0)