Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 7e9bf2a

Browse filesBrowse files
MathiasVPMathiasVP
committed
C++: Add a model for 'partial updating' and extend models appropriately.
1 parent 24a63ae commit 7e9bf2a
Copy full SHA for 7e9bf2a

File tree

Expand file treeCollapse file tree

15 files changed

+118
-30
lines changed
Filter options
Expand file treeCollapse file tree

15 files changed

+118
-30
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
+8-2Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ private import DataFlowImplCommon as DataFlowImplCommon
55
private import semmle.code.cpp.models.interfaces.Allocation as Alloc
66
private import semmle.code.cpp.models.interfaces.DataFlow as DataFlow
77
private import semmle.code.cpp.models.interfaces.Taint as Taint
8+
private import semmle.code.cpp.models.interfaces.PartialFlow as PartialFlow
89
private import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs as FIO
910
private import semmle.code.cpp.ir.internal.IRCppLanguage
1011
private import semmle.code.cpp.ir.dataflow.internal.ModelUtil
@@ -816,10 +817,15 @@ private predicate inOut(FIO::FunctionInput input, FIO::FunctionOutput output) {
816817
* flows to `n`).
817818
*/
818819
private predicate modeledFlowBarrier(Node n) {
819-
exists(FIO::FunctionInput input, FIO::FunctionOutput output, CallInstruction call |
820+
exists(
821+
FIO::FunctionInput input, FIO::FunctionOutput output, CallInstruction call,
822+
PartialFlow::PartialFlowFunction partialFlowFunc
823+
|
820824
n = callInput(call, input) and
821825
inOut(input, output) and
822-
exists(callOutput(call, output))
826+
exists(callOutput(call, output)) and
827+
partialFlowFunc = call.getStaticCallTarget() and
828+
not partialFlowFunc.isPartialWrite(output)
823829
|
824830
call.getStaticCallTarget().(DataFlow::DataFlowFunction).hasDataFlow(_, output)
825831
or

‎cpp/ql/lib/semmle/code/cpp/models/implementations/GetDelim.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/implementations/GetDelim.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ private class GetDelimFunction extends TaintFunction, AliasFunction, SideEffectF
1515
i.isParameter(3) and o.isParameterDeref(0)
1616
}
1717

18+
override predicate isPartialWrite(FunctionOutput o) { o.isParameterDeref(3) }
19+
1820
override predicate parameterNeverEscapes(int index) { index = [0, 1, 3] }
1921

2022
override predicate parameterEscapesOnlyViaReturn(int index) { none() }

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Gets.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/implementations/Gets.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ private class FgetsFunction extends DataFlowFunction, TaintFunction, ArrayFuncti
2727
output.isReturnValue()
2828
}
2929

30+
override predicate isPartialWrite(FunctionOutput output) { output.isParameterDeref(2) }
31+
3032
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
3133
input.isParameter(2) and
3234
output.isParameterDeref(0)

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Inet.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/implementations/Inet.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ private class InetAton extends TaintFunction, ArrayFunction {
2020
output.isParameterDeref(1)
2121
}
2222

23+
override predicate isPartialWrite(FunctionOutput output) { output.isParameterDeref(1) }
24+
2325
override predicate hasArrayInput(int bufParam) { bufParam = 0 }
2426

2527
override predicate hasArrayOutput(int bufParam) { bufParam = 1 }

‎cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,8 @@ private class StdSequenceContainerData extends TaintFunction {
118118
input.isReturnValueDeref() and
119119
output.isQualifierObject()
120120
}
121+
122+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
121123
}
122124

123125
/**
@@ -147,6 +149,8 @@ private class StdSequenceContainerPushModel extends StdSequenceContainerPush, Ta
147149
input.isParameterDeref(0) and
148150
output.isQualifierObject()
149151
}
152+
153+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
150154
}
151155

152156
/**
@@ -207,6 +211,8 @@ private class StdSequenceContainerInsertModel extends StdSequenceContainerInsert
207211
output.isReturnValue()
208212
)
209213
}
214+
215+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
210216
}
211217

212218
/**
@@ -263,6 +269,8 @@ private class StdSequenceContainerAt extends TaintFunction {
263269
input.isReturnValueDeref() and
264270
output.isQualifierObject()
265271
}
272+
273+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
266274
}
267275

268276
/**
@@ -297,6 +305,8 @@ private class StdSequenceEmplaceModel extends StdSequenceEmplace, TaintFunction
297305
output.isReturnValue()
298306
)
299307
}
308+
309+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
300310
}
301311

302312
/**
@@ -335,6 +345,8 @@ private class StdSequenceEmplaceBackModel extends StdSequenceEmplaceBack, TaintF
335345
input.isParameterDeref([0 .. this.getNumberOfParameters() - 1]) and
336346
output.isQualifierObject()
337347
}
348+
349+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
338350
}
339351

340352
/**

‎cpp/ql/lib/semmle/code/cpp/models/implementations/StdMap.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/implementations/StdMap.qll
+11Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
*/
44

55
import semmle.code.cpp.models.interfaces.Taint
6+
import semmle.code.cpp.models.interfaces.DataFlow
67
import semmle.code.cpp.models.interfaces.Iterator
78

89
/**
@@ -53,6 +54,8 @@ private class StdMapInsert extends TaintFunction {
5354
output.isReturnValue()
5455
)
5556
}
57+
58+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
5659
}
5760

5861
/**
@@ -75,6 +78,8 @@ private class StdMapEmplace extends TaintFunction {
7578
input.isQualifierObject() and
7679
output.isReturnValue()
7780
}
81+
82+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
7883
}
7984

8085
/**
@@ -102,6 +107,8 @@ private class StdMapTryEmplace extends TaintFunction {
102107
input.isQualifierObject() and
103108
output.isReturnValue()
104109
}
110+
111+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
105112
}
106113

107114
/**
@@ -115,6 +122,8 @@ private class StdMapMerge extends TaintFunction {
115122
input.isParameterDeref(0) and
116123
output.isQualifierObject()
117124
}
125+
126+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
118127
}
119128

120129
/**
@@ -132,6 +141,8 @@ private class StdMapAt extends TaintFunction {
132141
input.isReturnValueDeref() and
133142
output.isQualifierObject()
134143
}
144+
145+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
135146
}
136147

137148
/**

‎cpp/ql/lib/semmle/code/cpp/models/implementations/StdSet.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/implementations/StdSet.qll
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,8 @@ private class StdSetInsert extends TaintFunction {
6161
output.isReturnValue()
6262
)
6363
}
64+
65+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
6466
}
6567

6668
/**
@@ -82,6 +84,8 @@ private class StdSetEmplace extends TaintFunction {
8284
input.isQualifierObject() and
8385
output.isReturnValue()
8486
}
87+
88+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
8589
}
8690

8791
/**
@@ -95,6 +99,8 @@ private class StdSetMerge extends TaintFunction {
9599
input.isParameterDeref(0) and
96100
output.isQualifierObject()
97101
}
102+
103+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
98104
}
99105

100106
/**

‎cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll
+26Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,8 @@ private class StdStringDataModel extends StdStringData, StdStringTaintFunction {
129129
input.isReturnValueDeref() and
130130
output.isQualifierObject()
131131
}
132+
133+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
132134
}
133135

134136
/**
@@ -142,6 +144,8 @@ private class StdStringPush extends StdStringTaintFunction {
142144
input.isParameter(0) and
143145
output.isQualifierObject()
144146
}
147+
148+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
145149
}
146150

147151
/**
@@ -204,6 +208,8 @@ private class StdStringAppend extends StdStringTaintFunction {
204208
input.isReturnValueDeref() and
205209
output.isQualifierObject()
206210
}
211+
212+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
207213
}
208214

209215
/**
@@ -237,6 +243,8 @@ private class StdStringInsert extends StdStringTaintFunction {
237243
input.isReturnValueDeref() and
238244
output.isQualifierObject()
239245
}
246+
247+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
240248
}
241249

242250
/**
@@ -305,6 +313,8 @@ private class StdStringAt extends StdStringTaintFunction {
305313
input.isReturnValueDeref() and
306314
output.isQualifierObject()
307315
}
316+
317+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
308318
}
309319

310320
/**
@@ -338,6 +348,8 @@ private class StdIStreamIn extends DataFlowFunction, TaintFunction {
338348
input.isReturnValueDeref() and
339349
output.isQualifierObject()
340350
}
351+
352+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
341353
}
342354

343355
/**
@@ -358,6 +370,8 @@ private class StdIStreamInNonMember extends DataFlowFunction, TaintFunction {
358370
output.isReturnValueDeref()
359371
}
360372

373+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
374+
361375
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
362376
// flow from first parameter to second parameter
363377
input.isParameterDeref(0) and
@@ -403,6 +417,8 @@ private class StdIStreamRead extends DataFlowFunction, TaintFunction {
403417
output.isReturnValueDeref()
404418
}
405419

420+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
421+
406422
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
407423
// flow from qualifier to first parameter
408424
input.isQualifierObject() and
@@ -442,6 +458,8 @@ private class StdIStreamPutBack extends DataFlowFunction, TaintFunction {
442458
output.isReturnValueDeref()
443459
}
444460

461+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
462+
445463
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
446464
// flow from first parameter (value or pointer) to qualifier
447465
input.isParameter(0) and
@@ -478,6 +496,8 @@ private class StdIStreamGetLine extends DataFlowFunction, TaintFunction {
478496
output.isReturnValueDeref()
479497
}
480498

499+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
500+
481501
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
482502
// flow from qualifier to first parameter
483503
input.isQualifierObject() and
@@ -540,6 +560,8 @@ private class StdOStreamOut extends DataFlowFunction, TaintFunction {
540560
output.isReturnValueDeref()
541561
}
542562

563+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
564+
543565
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
544566
// flow from first parameter (value or pointer) to qualifier
545567
input.isParameter(0) and
@@ -579,6 +601,8 @@ private class StdOStreamOutNonMember extends DataFlowFunction, TaintFunction {
579601
output.isReturnValueDeref()
580602
}
581603

604+
override predicate isPartialWrite(FunctionOutput output) { output.isParameterDeref(0) }
605+
582606
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
583607
// flow from second parameter to first parameter
584608
input.isParameterDeref(1) and
@@ -672,6 +696,8 @@ private class StdStreamFunction extends DataFlowFunction, TaintFunction {
672696
output.isReturnValueDeref()
673697
}
674698

699+
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
700+
675701
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
676702
// reverse flow from returned reference to the qualifier
677703
input.isReturnValueDeref() and

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Strcrement.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/implementations/Strcrement.qll
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ private class Strcrement extends ArrayFunction, TaintFunction, SideEffectFunctio
3636
input.isParameter(index) and output.isReturnValue()
3737
or
3838
input.isParameterDeref(index) and output.isReturnValueDeref()
39+
or
40+
input.isParameterDeref(index) and output.isParameterDeref(index)
3941
)
4042
}
4143

‎cpp/ql/lib/semmle/code/cpp/models/interfaces/DataFlow.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/interfaces/DataFlow.qll
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import semmle.code.cpp.Function
1111
import FunctionInputsAndOutputs
1212
import semmle.code.cpp.models.Models
13+
import PartialFlow
1314

1415
/**
1516
* A library function for which a value is or may be copied from a parameter
@@ -18,7 +19,7 @@ import semmle.code.cpp.models.Models
1819
* Note that this does not include partial copying of values or partial writes
1920
* to destinations; that is covered by `TaintModel.qll`.
2021
*/
21-
abstract class DataFlowFunction extends Function {
22+
abstract class DataFlowFunction extends PartialFlowFunction {
2223
/**
2324
* Holds if data can be copied from the argument, qualifier, or buffer
2425
* represented by `input` to the return value or buffer represented by

‎cpp/ql/lib/semmle/code/cpp/models/interfaces/PartialFlow.qll

Copy file name to clipboard
+15Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import semmle.code.cpp.Function
2+
import FunctionInputsAndOutputs
3+
import semmle.code.cpp.models.Models
4+
5+
/**
6+
* A function that may (but not always) updates (part of) a `FunctionOutput`.
7+
*/
8+
abstract class PartialFlowFunction extends Function {
9+
/**
10+
* Holds if the write to `output` either is:
11+
* - Only partially updating the `output`
12+
* - Is not unconditional
13+
*/
14+
predicate isPartialWrite(FunctionOutput output) { none() }
15+
}

‎cpp/ql/lib/semmle/code/cpp/models/interfaces/Taint.qll

Copy file name to clipboardExpand all lines: cpp/ql/lib/semmle/code/cpp/models/interfaces/Taint.qll
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import semmle.code.cpp.Function
1111
import FunctionInputsAndOutputs
1212
import semmle.code.cpp.models.Models
13+
import PartialFlow
1314

1415
/**
1516
* A library function for which a taint-tracking library should propagate taint
@@ -23,7 +24,7 @@ import semmle.code.cpp.models.Models
2324
* altered (for example copying a string with `strncpy`), this is also considered
2425
* data flow.
2526
*/
26-
abstract class TaintFunction extends Function {
27+
abstract class TaintFunction extends PartialFlowFunction {
2728
/**
2829
* Holds if data passed into the argument, qualifier, or buffer represented by
2930
* `input` influences the return value or buffer represented by `output`

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Copy file name to clipboardExpand all lines: cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6490,6 +6490,7 @@ WARNING: Module TaintTracking has been deprecated and may be removed in future (
64906490
| taint.cpp:607:10:607:16 | call to _strinc | taint.cpp:609:8:609:12 | dest1 | |
64916491
| taint.cpp:607:18:607:23 | source | taint.cpp:607:10:607:16 | call to _strinc | TAINT |
64926492
| taint.cpp:607:26:607:31 | locale | taint.cpp:607:10:607:16 | call to _strinc | TAINT |
6493+
| taint.cpp:607:26:607:31 | locale | taint.cpp:607:26:607:31 | ref arg locale | TAINT |
64936494
| taint.cpp:607:26:607:31 | ref arg locale | taint.cpp:606:82:606:87 | locale | |
64946495
| taint.cpp:607:26:607:31 | ref arg locale | taint.cpp:611:25:611:30 | locale | |
64956496
| taint.cpp:608:7:608:11 | ref arg dest1 | taint.cpp:606:52:606:56 | dest1 | |
@@ -6501,6 +6502,7 @@ WARNING: Module TaintTracking has been deprecated and may be removed in future (
65016502
| taint.cpp:611:10:611:16 | call to _strinc | taint.cpp:613:8:613:12 | dest2 | |
65026503
| taint.cpp:611:18:611:22 | clean | taint.cpp:611:10:611:16 | call to _strinc | TAINT |
65036504
| taint.cpp:611:25:611:30 | locale | taint.cpp:611:10:611:16 | call to _strinc | TAINT |
6505+
| taint.cpp:611:25:611:30 | locale | taint.cpp:611:25:611:30 | ref arg locale | TAINT |
65046506
| taint.cpp:611:25:611:30 | ref arg locale | taint.cpp:606:82:606:87 | locale | |
65056507
| taint.cpp:612:7:612:11 | ref arg dest2 | taint.cpp:606:65:606:69 | dest2 | |
65066508
| taint.cpp:612:7:612:11 | ref arg dest2 | taint.cpp:613:8:613:12 | dest2 | |

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.