Skip to content

Commit 050d99f

Browse files
geoffw0geoffw0
committed
CPP: Add test cases.
1 parent ebc10cf commit 050d99f

File tree

5 files changed

+190
-0
lines changed

5 files changed

+190
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,3 +227,87 @@
227227
| taint.cpp:255:27:255:27 | b | taint.cpp:257:8:257:8 | b | |
228228
| taint.cpp:258:7:258:12 | call to source | taint.cpp:258:3:258:14 | ... = ... | |
229229
| taint.cpp:260:10:260:10 | ref arg w | taint.cpp:261:7:261:7 | w | |
230+
| taint.cpp:266:12:266:12 | x | taint.cpp:268:9:268:9 | x | |
231+
| taint.cpp:275:6:275:11 | call to source | taint.cpp:275:2:275:13 | ... = ... | |
232+
| taint.cpp:275:6:275:11 | call to source | taint.cpp:280:7:280:7 | t | |
233+
| taint.cpp:275:6:275:11 | call to source | taint.cpp:285:9:285:9 | t | |
234+
| taint.cpp:275:6:275:11 | call to source | taint.cpp:286:12:286:12 | t | |
235+
| taint.cpp:275:6:275:11 | call to source | taint.cpp:289:7:289:7 | t | |
236+
| taint.cpp:276:6:276:6 | 0 | taint.cpp:276:2:276:6 | ... = ... | |
237+
| taint.cpp:276:6:276:6 | 0 | taint.cpp:281:7:281:7 | x | |
238+
| taint.cpp:277:6:277:6 | 0 | taint.cpp:277:2:277:6 | ... = ... | |
239+
| taint.cpp:277:6:277:6 | 0 | taint.cpp:282:7:282:7 | y | |
240+
| taint.cpp:278:6:278:6 | 0 | taint.cpp:278:2:278:6 | ... = ... | |
241+
| taint.cpp:278:6:278:6 | 0 | taint.cpp:283:7:283:7 | z | |
242+
| taint.cpp:278:6:278:6 | 0 | taint.cpp:287:9:287:9 | z | |
243+
| taint.cpp:285:6:285:7 | call to id | taint.cpp:285:2:285:10 | ... = ... | |
244+
| taint.cpp:285:6:285:7 | call to id | taint.cpp:290:7:290:7 | x | |
245+
| taint.cpp:286:6:286:7 | call to id | taint.cpp:286:2:286:14 | ... = ... | |
246+
| taint.cpp:286:6:286:7 | call to id | taint.cpp:291:7:291:7 | y | |
247+
| taint.cpp:287:6:287:7 | call to id | taint.cpp:287:2:287:10 | ... = ... | |
248+
| taint.cpp:287:6:287:7 | call to id | taint.cpp:292:7:292:7 | z | |
249+
| taint.cpp:297:29:297:29 | b | taint.cpp:299:6:299:6 | b | |
250+
| taint.cpp:299:6:299:6 | b | taint.cpp:299:2:299:6 | ... = ... | |
251+
| taint.cpp:302:28:302:28 | b | taint.cpp:304:6:304:6 | b | |
252+
| taint.cpp:304:6:304:6 | b | taint.cpp:304:2:304:6 | ... = ... | |
253+
| taint.cpp:307:21:307:21 | a | taint.cpp:309:3:309:3 | a | |
254+
| taint.cpp:307:28:307:28 | b | taint.cpp:309:7:309:7 | b | |
255+
| taint.cpp:309:3:309:3 | a | taint.cpp:309:2:309:3 | * ... | TAINT |
256+
| taint.cpp:309:7:309:7 | b | taint.cpp:309:2:309:7 | ... = ... | |
257+
| taint.cpp:312:21:312:21 | a | taint.cpp:317:3:317:3 | a | |
258+
| taint.cpp:312:28:312:28 | b | taint.cpp:316:6:316:6 | b | |
259+
| taint.cpp:316:6:316:6 | b | taint.cpp:316:6:316:10 | ... + ... | TAINT |
260+
| taint.cpp:316:6:316:10 | ... + ... | taint.cpp:316:2:316:10 | ... = ... | |
261+
| taint.cpp:316:6:316:10 | ... + ... | taint.cpp:317:7:317:7 | c | |
262+
| taint.cpp:316:10:316:10 | 1 | taint.cpp:316:6:316:10 | ... + ... | TAINT |
263+
| taint.cpp:317:3:317:3 | a | taint.cpp:317:2:317:3 | * ... | TAINT |
264+
| taint.cpp:317:7:317:7 | c | taint.cpp:317:2:317:7 | ... = ... | |
265+
| taint.cpp:320:23:320:23 | a | taint.cpp:322:6:322:6 | a | |
266+
| taint.cpp:320:31:320:31 | b | taint.cpp:323:6:323:6 | b | |
267+
| taint.cpp:322:6:322:6 | a | taint.cpp:322:6:322:10 | ... + ... | TAINT |
268+
| taint.cpp:322:6:322:10 | ... + ... | taint.cpp:322:2:322:10 | ... = ... | |
269+
| taint.cpp:322:10:322:10 | 1 | taint.cpp:322:6:322:10 | ... + ... | TAINT |
270+
| taint.cpp:323:6:323:6 | b | taint.cpp:323:6:323:10 | ... + ... | TAINT |
271+
| taint.cpp:323:6:323:10 | ... + ... | taint.cpp:323:2:323:10 | ... = ... | |
272+
| taint.cpp:323:10:323:10 | 1 | taint.cpp:323:6:323:10 | ... + ... | TAINT |
273+
| taint.cpp:330:6:330:11 | call to source | taint.cpp:330:2:330:13 | ... = ... | |
274+
| taint.cpp:330:6:330:11 | call to source | taint.cpp:337:7:337:7 | t | |
275+
| taint.cpp:330:6:330:11 | call to source | taint.cpp:344:15:344:15 | t | |
276+
| taint.cpp:330:6:330:11 | call to source | taint.cpp:345:15:345:15 | t | |
277+
| taint.cpp:330:6:330:11 | call to source | taint.cpp:346:16:346:16 | t | |
278+
| taint.cpp:330:6:330:11 | call to source | taint.cpp:347:16:347:16 | t | |
279+
| taint.cpp:330:6:330:11 | call to source | taint.cpp:348:17:348:17 | t | |
280+
| taint.cpp:330:6:330:11 | call to source | taint.cpp:350:7:350:7 | t | |
281+
| taint.cpp:331:6:331:6 | 0 | taint.cpp:331:2:331:6 | ... = ... | |
282+
| taint.cpp:331:6:331:6 | 0 | taint.cpp:338:7:338:7 | a | |
283+
| taint.cpp:331:6:331:6 | 0 | taint.cpp:344:12:344:12 | a | |
284+
| taint.cpp:331:6:331:6 | 0 | taint.cpp:351:7:351:7 | a | |
285+
| taint.cpp:332:6:332:6 | 0 | taint.cpp:332:2:332:6 | ... = ... | |
286+
| taint.cpp:332:6:332:6 | 0 | taint.cpp:339:7:339:7 | b | |
287+
| taint.cpp:332:6:332:6 | 0 | taint.cpp:345:12:345:12 | b | |
288+
| taint.cpp:332:6:332:6 | 0 | taint.cpp:352:7:352:7 | b | |
289+
| taint.cpp:333:6:333:6 | 0 | taint.cpp:333:2:333:6 | ... = ... | |
290+
| taint.cpp:333:6:333:6 | 0 | taint.cpp:340:7:340:7 | c | |
291+
| taint.cpp:333:6:333:6 | 0 | taint.cpp:346:13:346:13 | c | |
292+
| taint.cpp:333:6:333:6 | 0 | taint.cpp:353:7:353:7 | c | |
293+
| taint.cpp:334:6:334:6 | 0 | taint.cpp:334:2:334:6 | ... = ... | |
294+
| taint.cpp:334:6:334:6 | 0 | taint.cpp:341:7:341:7 | d | |
295+
| taint.cpp:334:6:334:6 | 0 | taint.cpp:347:13:347:13 | d | |
296+
| taint.cpp:334:6:334:6 | 0 | taint.cpp:354:7:354:7 | d | |
297+
| taint.cpp:335:6:335:6 | 0 | taint.cpp:335:2:335:6 | ... = ... | |
298+
| taint.cpp:335:6:335:6 | 0 | taint.cpp:342:7:342:7 | e | |
299+
| taint.cpp:335:6:335:6 | 0 | taint.cpp:348:14:348:14 | e | |
300+
| taint.cpp:335:6:335:6 | 0 | taint.cpp:355:7:355:7 | e | |
301+
| taint.cpp:344:12:344:12 | ref arg a | taint.cpp:351:7:351:7 | a | |
302+
| taint.cpp:344:15:344:15 | ref arg t | taint.cpp:345:15:345:15 | t | |
303+
| taint.cpp:344:15:344:15 | ref arg t | taint.cpp:346:16:346:16 | t | |
304+
| taint.cpp:344:15:344:15 | ref arg t | taint.cpp:347:16:347:16 | t | |
305+
| taint.cpp:344:15:344:15 | ref arg t | taint.cpp:348:17:348:17 | t | |
306+
| taint.cpp:344:15:344:15 | ref arg t | taint.cpp:350:7:350:7 | t | |
307+
| taint.cpp:345:12:345:12 | ref arg b | taint.cpp:352:7:352:7 | b | |
308+
| taint.cpp:346:12:346:13 | ref arg & ... | taint.cpp:353:7:353:7 | c | |
309+
| taint.cpp:346:13:346:13 | c | taint.cpp:346:12:346:13 | & ... | |
310+
| taint.cpp:347:12:347:13 | ref arg & ... | taint.cpp:354:7:354:7 | d | |
311+
| taint.cpp:347:13:347:13 | d | taint.cpp:347:12:347:13 | & ... | |
312+
| taint.cpp:348:14:348:14 | ref arg e | taint.cpp:355:7:355:7 | e | |
313+
| taint.cpp:348:17:348:17 | ref arg t | taint.cpp:350:7:350:7 | t | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,3 +260,97 @@ void test_lambdas()
260260
e(t, u, w);
261261
sink(w); // tainted [NOT DETECTED]
262262
}
263+
264+
// --- taint through return value ---
265+
266+
int id(int x)
267+
{
268+
return x;
269+
}
270+
271+
void test_return()
272+
{
273+
int x, y, z, t;
274+
275+
t = source();
276+
x = 0;
277+
y = 0;
278+
z = 0;
279+
280+
sink(t); // tainted
281+
sink(x);
282+
sink(y);
283+
sink(z);
284+
285+
x = id(t);
286+
y = id(id(t));
287+
z = id(z);
288+
289+
sink(t); // tainted
290+
sink(x); // tainted
291+
sink(y); // tainted
292+
sink(z);
293+
}
294+
295+
// --- taint through parameters ---
296+
297+
void myAssign1(int &a, int &b)
298+
{
299+
a = b;
300+
}
301+
302+
void myAssign2(int &a, int b)
303+
{
304+
a = b;
305+
}
306+
307+
void myAssign3(int *a, int b)
308+
{
309+
*a = b;
310+
}
311+
312+
void myAssign4(int *a, int b)
313+
{
314+
int c;
315+
316+
c = b + 1;
317+
*a = c;
318+
}
319+
320+
void myNotAssign(int &a, int &b)
321+
{
322+
a = a + 1;
323+
b = b + 1;
324+
}
325+
326+
void test_outparams()
327+
{
328+
int t, a, b, c, d, e;
329+
330+
t = source();
331+
a = 0;
332+
b = 0;
333+
c = 0;
334+
d = 0;
335+
e = 0;
336+
337+
sink(t); // tainted
338+
sink(a);
339+
sink(b);
340+
sink(c);
341+
sink(d);
342+
sink(e);
343+
344+
myAssign1(a, t);
345+
myAssign2(b, t);
346+
myAssign3(&c, t);
347+
myAssign4(&d, t);
348+
myNotAssign(e, t);
349+
350+
sink(t); // tainted
351+
sink(a); // tainted [NOT DETECTED]
352+
sink(b); // tainted [NOT DETECTED]
353+
sink(c); // tainted [NOT DETECTED]
354+
sink(d); // tainted [NOT DETECTED]
355+
sink(e);
356+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,9 @@
2828
| taint.cpp:244:3:244:6 | t | taint.cpp:223:10:223:15 | call to source |
2929
| taint.cpp:250:8:250:8 | a | taint.cpp:223:10:223:15 | call to source |
3030
| taint.cpp:256:8:256:8 | a | taint.cpp:223:10:223:15 | call to source |
31+
| taint.cpp:280:7:280:7 | t | taint.cpp:275:6:275:11 | call to source |
32+
| taint.cpp:289:7:289:7 | t | taint.cpp:275:6:275:11 | call to source |
33+
| taint.cpp:290:7:290:7 | x | taint.cpp:275:6:275:11 | call to source |
34+
| taint.cpp:291:7:291:7 | y | taint.cpp:275:6:275:11 | call to source |
35+
| taint.cpp:337:7:337:7 | t | taint.cpp:330:6:330:11 | call to source |
36+
| taint.cpp:350:7:350:7 | t | taint.cpp:330:6:330:11 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@
2121
| taint.cpp:244:3:244:6 | taint.cpp:223:10:223:15 | AST only |
2222
| taint.cpp:250:8:250:8 | taint.cpp:223:10:223:15 | AST only |
2323
| taint.cpp:256:8:256:8 | taint.cpp:223:10:223:15 | AST only |
24+
| taint.cpp:350:7:350:7 | taint.cpp:330:6:330:11 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,8 @@
99
| taint.cpp:167:8:167:13 | Call: call to source | taint.cpp:167:8:167:13 | Call: call to source |
1010
| taint.cpp:168:8:168:14 | Load: tainted | taint.cpp:164:19:164:24 | Call: call to source |
1111
| taint.cpp:210:7:210:7 | Load: x | taint.cpp:207:6:207:11 | Call: call to source |
12+
| taint.cpp:280:7:280:7 | Load: t | taint.cpp:275:6:275:11 | Call: call to source |
13+
| taint.cpp:289:7:289:7 | Load: t | taint.cpp:275:6:275:11 | Call: call to source |
14+
| taint.cpp:290:7:290:7 | Load: x | taint.cpp:275:6:275:11 | Call: call to source |
15+
| taint.cpp:291:7:291:7 | Load: y | taint.cpp:275:6:275:11 | Call: call to source |
16+
| taint.cpp:337:7:337:7 | Load: t | taint.cpp:330:6:330:11 | Call: call to source |

0 commit comments

Comments
 (0)