Skip to content

Commit 258d2c1

Browse files
rdmarsh2rdmarsh2
committed
C++: require that other operands be predictable
This brings back a constraint that was lost when switching DefaultTaintTracking to use a TaintTracking::Configuration
1 parent add1d13 commit 258d2c1

File tree

4 files changed

+19
-56
lines changed

4 files changed

+19
-56
lines changed

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,6 +181,25 @@ private predicate nodeIsBarrier(DataFlow::Node node) {
181181
private predicate nodeIsBarrierIn(DataFlow::Node node) {
182182
// don't use dataflow into taint sources, as this leads to duplicate results.
183183
node = getNodeForSource(any(Expr e))
184+
or
185+
// don't use dataflow into binary instructions if both operands are unpredictable
186+
exists(BinaryInstruction iTo |
187+
iTo = node.asInstruction() and
188+
not predictableInstruction(iTo.getLeft()) and
189+
not predictableInstruction(iTo.getRight())
190+
)
191+
or
192+
// don't use dataflow through calls to pure functions if two or more operands
193+
// are unpredictable
194+
exists(Instruction iFrom1, Instruction iFrom2, CallInstruction iTo |
195+
iTo = node.asInstruction() and
196+
isPureFunction(iTo.getStaticCallTarget().getName()) and
197+
iFrom1 = iTo.getAnArgument() and
198+
iFrom2 = iTo.getAnArgument() and
199+
not predictableInstruction(iFrom1) and
200+
not predictableInstruction(iFrom2) and
201+
iFrom1 != iFrom2
202+
)
184203
}
185204

186205
cached

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -27,21 +27,6 @@ edges
2727
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
2828
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
2929
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
30-
| test.cpp:75:25:75:29 | start | test.cpp:79:18:79:28 | ... - ... |
31-
| test.cpp:75:25:75:29 | start | test.cpp:79:18:79:28 | ... - ... |
32-
| test.cpp:75:38:75:40 | end | test.cpp:79:18:79:28 | ... - ... |
33-
| test.cpp:75:38:75:40 | end | test.cpp:79:18:79:28 | ... - ... |
34-
| test.cpp:97:18:97:23 | buffer | test.cpp:100:17:100:22 | array to pointer conversion |
35-
| test.cpp:97:18:97:23 | buffer | test.cpp:101:17:101:22 | array to pointer conversion |
36-
| test.cpp:97:18:97:23 | buffer | test.cpp:101:25:101:39 | ... + ... |
37-
| test.cpp:97:18:97:23 | fread output argument | test.cpp:100:17:100:22 | array to pointer conversion |
38-
| test.cpp:97:18:97:23 | fread output argument | test.cpp:101:17:101:22 | array to pointer conversion |
39-
| test.cpp:97:18:97:23 | fread output argument | test.cpp:101:25:101:39 | ... + ... |
40-
| test.cpp:100:17:100:22 | array to pointer conversion | test.cpp:100:17:100:22 | processData1 output argument |
41-
| test.cpp:100:17:100:22 | processData1 output argument | test.cpp:101:17:101:22 | array to pointer conversion |
42-
| test.cpp:100:17:100:22 | processData1 output argument | test.cpp:101:25:101:39 | ... + ... |
43-
| test.cpp:101:17:101:22 | array to pointer conversion | test.cpp:75:25:75:29 | start |
44-
| test.cpp:101:25:101:39 | ... + ... | test.cpp:75:38:75:40 | end |
4530
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
4631
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
4732
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:41 | ... * ... |
@@ -99,19 +84,6 @@ nodes
9984
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
10085
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
10186
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
102-
| test.cpp:64:25:64:30 | InitializeIndirection | semmle.label | InitializeIndirection |
103-
| test.cpp:64:25:64:30 | buffer | semmle.label | buffer |
104-
| test.cpp:75:25:75:29 | start | semmle.label | start |
105-
| test.cpp:75:38:75:40 | end | semmle.label | end |
106-
| test.cpp:79:18:79:28 | ... - ... | semmle.label | ... - ... |
107-
| test.cpp:79:18:79:28 | ... - ... | semmle.label | ... - ... |
108-
| test.cpp:79:18:79:28 | ... - ... | semmle.label | ... - ... |
109-
| test.cpp:97:18:97:23 | buffer | semmle.label | buffer |
110-
| test.cpp:97:18:97:23 | fread output argument | semmle.label | fread output argument |
111-
| test.cpp:100:17:100:22 | array to pointer conversion | semmle.label | array to pointer conversion |
112-
| test.cpp:100:17:100:22 | processData1 output argument | semmle.label | processData1 output argument |
113-
| test.cpp:101:17:101:22 | array to pointer conversion | semmle.label | array to pointer conversion |
114-
| test.cpp:101:25:101:39 | ... + ... | semmle.label | ... + ... |
11587
| test.cpp:123:18:123:23 | call to getenv | semmle.label | call to getenv |
11688
| test.cpp:123:18:123:31 | (const char *)... | semmle.label | (const char *)... |
11789
| test.cpp:127:24:127:41 | ... * ... | semmle.label | ... * ... |
@@ -157,7 +129,6 @@ nodes
157129
| test.cpp:48:25:48:30 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
158130
| test.cpp:49:17:49:30 | new[] | test.cpp:39:21:39:24 | argv | test.cpp:49:26:49:29 | size | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
159131
| test.cpp:52:21:52:27 | call to realloc | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
160-
| test.cpp:79:9:79:29 | new[] | test.cpp:97:18:97:23 | buffer | test.cpp:79:18:79:28 | ... - ... | This allocation size is derived from $@ and might overflow | test.cpp:97:18:97:23 | buffer | user input (fread) |
161132
| test.cpp:127:17:127:22 | call to malloc | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:123:18:123:23 | call to getenv | user input (getenv) |
162133
| test.cpp:134:3:134:8 | call to malloc | test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:132:19:132:24 | call to getenv | user input (getenv) |
163134
| test.cpp:142:4:142:9 | call to malloc | test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:138:19:138:24 | call to getenv | user input (getenv) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,6 @@ edges
3535
| test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r |
3636
| test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r |
3737
| test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r |
38-
| test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r |
39-
| test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r |
40-
| test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r |
41-
| test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r |
42-
| test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r |
43-
| test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r |
44-
| test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r |
45-
| test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r |
4638
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
4739
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
4840
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
@@ -96,13 +88,6 @@ nodes
9688
| test.c:77:9:77:9 | r | semmle.label | r |
9789
| test.c:77:9:77:9 | r | semmle.label | r |
9890
| test.c:77:9:77:9 | r | semmle.label | r |
99-
| test.c:81:14:81:17 | call to rand | semmle.label | call to rand |
100-
| test.c:81:14:81:17 | call to rand | semmle.label | call to rand |
101-
| test.c:81:23:81:26 | call to rand | semmle.label | call to rand |
102-
| test.c:81:23:81:26 | call to rand | semmle.label | call to rand |
103-
| test.c:83:9:83:9 | r | semmle.label | r |
104-
| test.c:83:9:83:9 | r | semmle.label | r |
105-
| test.c:83:9:83:9 | r | semmle.label | r |
10691
| test.c:99:14:99:19 | call to rand | semmle.label | call to rand |
10792
| test.c:99:14:99:19 | call to rand | semmle.label | call to rand |
10893
| test.c:100:5:100:5 | r | semmle.label | r |
@@ -123,7 +108,5 @@ nodes
123108
| test.c:56:5:56:5 | r | test.c:54:13:54:16 | call to rand | test.c:56:5:56:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:54:13:54:16 | call to rand | Uncontrolled value |
124109
| test.c:67:5:67:5 | r | test.c:66:13:66:16 | call to rand | test.c:67:5:67:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:66:13:66:16 | call to rand | Uncontrolled value |
125110
| test.c:77:9:77:9 | r | test.c:75:13:75:19 | ... ^ ... | test.c:77:9:77:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:75:13:75:19 | ... ^ ... | Uncontrolled value |
126-
| test.c:83:9:83:9 | r | test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:81:14:81:17 | call to rand | Uncontrolled value |
127-
| test.c:83:9:83:9 | r | test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:81:23:81:26 | call to rand | Uncontrolled value |
128111
| test.c:100:5:100:5 | r | test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:99:14:99:19 | call to rand | Uncontrolled value |
129112
| test.cpp:25:7:25:7 | r | test.cpp:8:9:8:12 | call to rand | test.cpp:25:7:25:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:8:9:8:12 | call to rand | Uncontrolled value |

‎cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,25 +7,15 @@ edges
77
| test.cpp:20:29:20:47 | (const char *)... | test.cpp:24:11:24:16 | call to strcmp |
88
| test.cpp:20:29:20:47 | (const char *)... | test.cpp:41:10:41:38 | ! ... |
99
| test.cpp:20:29:20:47 | (const char *)... | test.cpp:41:11:41:16 | call to strcmp |
10-
| test.cpp:29:27:29:32 | call to getenv | test.cpp:30:10:30:37 | ! ... |
11-
| test.cpp:29:27:29:32 | call to getenv | test.cpp:30:11:30:16 | call to strcmp |
12-
| test.cpp:29:27:29:42 | (const char *)... | test.cpp:30:10:30:37 | ! ... |
13-
| test.cpp:29:27:29:42 | (const char *)... | test.cpp:30:11:30:16 | call to strcmp |
1410
nodes
1511
| test.cpp:20:29:20:34 | call to getenv | semmle.label | call to getenv |
1612
| test.cpp:20:29:20:47 | (const char *)... | semmle.label | (const char *)... |
1713
| test.cpp:24:10:24:35 | ! ... | semmle.label | ! ... |
1814
| test.cpp:24:11:24:16 | call to strcmp | semmle.label | call to strcmp |
1915
| test.cpp:24:11:24:16 | call to strcmp | semmle.label | call to strcmp |
20-
| test.cpp:29:27:29:32 | call to getenv | semmle.label | call to getenv |
21-
| test.cpp:29:27:29:42 | (const char *)... | semmle.label | (const char *)... |
22-
| test.cpp:30:10:30:37 | ! ... | semmle.label | ! ... |
23-
| test.cpp:30:11:30:16 | call to strcmp | semmle.label | call to strcmp |
24-
| test.cpp:30:11:30:16 | call to strcmp | semmle.label | call to strcmp |
2516
| test.cpp:41:10:41:38 | ! ... | semmle.label | ! ... |
2617
| test.cpp:41:11:41:16 | call to strcmp | semmle.label | call to strcmp |
2718
| test.cpp:41:11:41:16 | call to strcmp | semmle.label | call to strcmp |
2819
#select
2920
| test.cpp:24:10:24:35 | ! ... | test.cpp:20:29:20:34 | call to getenv | test.cpp:24:10:24:35 | ! ... | Reliance on untrusted input $@ to raise privilege at $@ | test.cpp:20:29:20:34 | call to getenv | call to getenv | test.cpp:25:9:25:27 | ... = ... | ... = ... |
30-
| test.cpp:30:10:30:37 | ! ... | test.cpp:29:27:29:32 | call to getenv | test.cpp:30:10:30:37 | ! ... | Reliance on untrusted input $@ to raise privilege at $@ | test.cpp:29:27:29:32 | call to getenv | call to getenv | test.cpp:31:9:31:27 | ... = ... | ... = ... |
3121
| test.cpp:41:10:41:38 | ! ... | test.cpp:20:29:20:34 | call to getenv | test.cpp:41:10:41:38 | ! ... | Reliance on untrusted input $@ to raise privilege at $@ | test.cpp:20:29:20:34 | call to getenv | call to getenv | test.cpp:42:8:42:26 | ... = ... | ... = ... |

0 commit comments

Comments
 (0)