Skip to content

Commit add1d13

Browse files
rdmarsh2rdmarsh2
committed
C++: pointer arg conflation in TaintTrackingUtil
Bring the temporary conflation of pointers and objects at function arguments and parameters into TaintTrackingUtil, since we don't have precise flow for indirections yet. The new result in TaintedAllocationSize.expected is a false positive, since the tainted ranges cancel out.
1 parent 560ee8d commit add1d13

File tree

7 files changed

+171
-7
lines changed

7 files changed

+171
-7
lines changed

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,22 @@ private predicate localInstructionTaintStep(Instruction nodeFrom, Instruction no
6767
or
6868
t instanceof ArrayType
6969
)
70+
or
71+
// Until we have from through indirections across calls, we'll take flow out
72+
// of the parameter and into its indirection.
73+
exists(IRFunction f, Parameter parameter |
74+
nodeFrom = getInitializeParameter(f, parameter) and
75+
nodeTo = getInitializeIndirection(f, parameter)
76+
)
77+
or
78+
// Until we have flow through indirections across calls, we'll take flow out
79+
// of the indirection and into the argument.
80+
// When we get proper flow through indirections across calls, this code can be
81+
// moved to `adjusedSink` or possibly into the `DataFlow::ExprNode` class.
82+
exists(ReadSideEffectInstruction read |
83+
read.getAnOperand().(SideEffectOperand).getAnyDef() = nodeFrom and
84+
read.getArgumentDef() = nodeTo
85+
)
7086
}
7187

7288
/**
@@ -135,3 +151,15 @@ predicate modeledInstructionTaintStep(Instruction instrIn, Instruction instrOut)
135151
modelMidIn.isParameter(indexMid)
136152
)
137153
}
154+
155+
pragma[noinline]
156+
private InitializeIndirectionInstruction getInitializeIndirection(IRFunction f, Parameter p) {
157+
result.getParameter() = p and
158+
result.getEnclosingIRFunction() = f
159+
}
160+
161+
pragma[noinline]
162+
private InitializeParameterInstruction getInitializeParameter(IRFunction f, Parameter p) {
163+
result.getParameter() = p and
164+
result.getEnclosingIRFunction() = f
165+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,21 +27,14 @@
2727
| taint.cpp:112:7:112:13 | taint.cpp:106:12:106:17 | IR only |
2828
| taint.cpp:130:7:130:9 | taint.cpp:127:8:127:13 | IR only |
2929
| taint.cpp:137:7:137:9 | taint.cpp:120:11:120:16 | AST only |
30-
| taint.cpp:173:8:173:13 | taint.cpp:164:19:164:24 | AST only |
31-
| taint.cpp:181:8:181:9 | taint.cpp:185:11:185:16 | AST only |
32-
| taint.cpp:195:7:195:7 | taint.cpp:192:23:192:28 | AST only |
3330
| taint.cpp:195:7:195:7 | taint.cpp:193:6:193:6 | AST only |
3431
| taint.cpp:229:3:229:6 | taint.cpp:223:10:223:15 | AST only |
3532
| taint.cpp:233:8:233:8 | taint.cpp:223:10:223:15 | AST only |
3633
| taint.cpp:236:3:236:6 | taint.cpp:223:10:223:15 | AST only |
3734
| taint.cpp:244:3:244:6 | taint.cpp:223:10:223:15 | AST only |
38-
| taint.cpp:256:8:256:8 | taint.cpp:223:10:223:15 | AST only |
3935
| taint.cpp:261:7:261:7 | taint.cpp:258:7:258:12 | AST only |
4036
| taint.cpp:351:7:351:7 | taint.cpp:330:6:330:11 | AST only |
4137
| taint.cpp:352:7:352:7 | taint.cpp:330:6:330:11 | AST only |
42-
| taint.cpp:372:7:372:7 | taint.cpp:365:24:365:29 | AST only |
43-
| taint.cpp:374:7:374:7 | taint.cpp:365:24:365:29 | AST only |
44-
| taint.cpp:391:7:391:7 | taint.cpp:385:27:385:32 | AST only |
4538
| taint.cpp:423:7:423:7 | taint.cpp:422:14:422:19 | AST only |
4639
| taint.cpp:424:9:424:17 | taint.cpp:422:14:422:19 | AST only |
4740
| taint.cpp:429:7:429:7 | taint.cpp:428:13:428:18 | IR only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,17 +13,25 @@
1313
| taint.cpp:151:7:151:12 | call to select | taint.cpp:151:20:151:25 | call to source |
1414
| taint.cpp:167:8:167:13 | call to source | taint.cpp:167:8:167:13 | call to source |
1515
| taint.cpp:168:8:168:14 | tainted | taint.cpp:164:19:164:24 | call to source |
16+
| taint.cpp:173:8:173:13 | array to pointer conversion | taint.cpp:164:19:164:24 | call to source |
17+
| taint.cpp:181:8:181:9 | * ... | taint.cpp:185:11:185:16 | call to source |
18+
| taint.cpp:195:7:195:7 | x | taint.cpp:192:23:192:28 | source |
1619
| taint.cpp:210:7:210:7 | x | taint.cpp:207:6:207:11 | call to source |
1720
| taint.cpp:215:7:215:7 | x | taint.cpp:207:6:207:11 | call to source |
1821
| taint.cpp:216:7:216:7 | y | taint.cpp:207:6:207:11 | call to source |
1922
| taint.cpp:250:8:250:8 | a | taint.cpp:223:10:223:15 | call to source |
23+
| taint.cpp:256:8:256:8 | (reference dereference) | taint.cpp:223:10:223:15 | call to source |
24+
| taint.cpp:256:8:256:8 | a | taint.cpp:223:10:223:15 | call to source |
2025
| taint.cpp:280:7:280:7 | t | taint.cpp:275:6:275:11 | call to source |
2126
| taint.cpp:289:7:289:7 | t | taint.cpp:275:6:275:11 | call to source |
2227
| taint.cpp:290:7:290:7 | x | taint.cpp:275:6:275:11 | call to source |
2328
| taint.cpp:291:7:291:7 | y | taint.cpp:275:6:275:11 | call to source |
2429
| taint.cpp:337:7:337:7 | t | taint.cpp:330:6:330:11 | call to source |
2530
| taint.cpp:350:7:350:7 | t | taint.cpp:330:6:330:11 | call to source |
31+
| taint.cpp:372:7:372:7 | a | taint.cpp:365:24:365:29 | source |
32+
| taint.cpp:374:7:374:7 | c | taint.cpp:365:24:365:29 | source |
2633
| taint.cpp:382:7:382:7 | a | taint.cpp:377:23:377:28 | source |
34+
| taint.cpp:391:7:391:7 | a | taint.cpp:385:27:385:32 | source |
2735
| taint.cpp:429:7:429:7 | b | taint.cpp:428:13:428:18 | call to source |
2836
| taint.cpp:430:9:430:14 | member | taint.cpp:428:13:428:18 | call to source |
2937
| taint.cpp:465:7:465:7 | x | taint.cpp:462:6:462:11 | call to source |

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/semmle/tests/TaintedPath.expected

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
11
edges
2+
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | (const char *)... |
3+
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | (const char *)... |
4+
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
5+
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName |
26
nodes
7+
| test.c:9:23:9:26 | argv | semmle.label | argv |
8+
| test.c:9:23:9:26 | argv | semmle.label | argv |
9+
| test.c:17:11:17:18 | (const char *)... | semmle.label | (const char *)... |
10+
| test.c:17:11:17:18 | (const char *)... | semmle.label | (const char *)... |
11+
| test.c:17:11:17:18 | fileName | semmle.label | fileName |
312
#select
13+
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | fileName | This argument to a file access function is derived from $@ and then passed to fopen(filename) | test.c:9:23:9:26 | argv | user input (argv) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,29 @@ edges
4949
| argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
5050
| argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
5151
| argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... |
52+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | (const char *)... |
53+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | (const char *)... |
54+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 |
55+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 |
56+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
57+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
58+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
59+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | array to pointer conversion |
60+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 |
61+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 |
62+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | (const char *)... |
63+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | (const char *)... |
64+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | ... + ... |
65+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | ... + ... |
66+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
67+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
68+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
69+
| argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... |
70+
| argvLocal.c:128:15:128:16 | array to pointer conversion | argvLocal.c:128:15:128:16 | printWrapper output argument |
71+
| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:131:9:131:14 | (const char *)... |
72+
| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:131:9:131:14 | ... + ... |
73+
| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:132:15:132:20 | ... + ... |
74+
| argvLocal.c:128:15:128:16 | printWrapper output argument | argvLocal.c:132:15:132:20 | ... + ... |
5275
| argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | (const char *)... |
5376
| argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | (const char *)... |
5477
| argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 |
@@ -74,6 +97,8 @@ edges
7497
| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
7598
| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
7699
nodes
100+
| argvLocal.c:9:25:9:31 | correct | semmle.label | correct |
101+
| argvLocal.c:10:9:10:15 | Chi | semmle.label | Chi |
77102
| argvLocal.c:95:9:95:12 | argv | semmle.label | argv |
78103
| argvLocal.c:95:9:95:12 | argv | semmle.label | argv |
79104
| argvLocal.c:95:9:95:15 | (const char *)... | semmle.label | (const char *)... |
@@ -114,6 +139,21 @@ nodes
114139
| argvLocal.c:111:15:111:17 | * ... | semmle.label | * ... |
115140
| argvLocal.c:111:15:111:17 | * ... | semmle.label | * ... |
116141
| argvLocal.c:111:15:111:17 | * ... | semmle.label | * ... |
142+
| argvLocal.c:126:10:126:13 | argv | semmle.label | argv |
143+
| argvLocal.c:126:10:126:13 | argv | semmle.label | argv |
144+
| argvLocal.c:127:9:127:10 | (const char *)... | semmle.label | (const char *)... |
145+
| argvLocal.c:127:9:127:10 | (const char *)... | semmle.label | (const char *)... |
146+
| argvLocal.c:127:9:127:10 | i5 | semmle.label | i5 |
147+
| argvLocal.c:128:15:128:16 | array to pointer conversion | semmle.label | array to pointer conversion |
148+
| argvLocal.c:128:15:128:16 | array to pointer conversion | semmle.label | array to pointer conversion |
149+
| argvLocal.c:128:15:128:16 | i5 | semmle.label | i5 |
150+
| argvLocal.c:128:15:128:16 | printWrapper output argument | semmle.label | printWrapper output argument |
151+
| argvLocal.c:131:9:131:14 | (const char *)... | semmle.label | (const char *)... |
152+
| argvLocal.c:131:9:131:14 | (const char *)... | semmle.label | (const char *)... |
153+
| argvLocal.c:131:9:131:14 | ... + ... | semmle.label | ... + ... |
154+
| argvLocal.c:132:15:132:20 | ... + ... | semmle.label | ... + ... |
155+
| argvLocal.c:132:15:132:20 | ... + ... | semmle.label | ... + ... |
156+
| argvLocal.c:132:15:132:20 | ... + ... | semmle.label | ... + ... |
117157
| argvLocal.c:144:9:144:10 | (const char *)... | semmle.label | (const char *)... |
118158
| argvLocal.c:144:9:144:10 | (const char *)... | semmle.label | (const char *)... |
119159
| argvLocal.c:144:9:144:10 | i7 | semmle.label | i7 |
@@ -155,6 +195,10 @@ nodes
155195
| argvLocal.c:107:15:107:19 | access to array | argvLocal.c:105:14:105:17 | argv | argvLocal.c:107:15:107:19 | access to array | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:105:14:105:17 | argv | argv |
156196
| argvLocal.c:110:9:110:11 | * ... | argvLocal.c:105:14:105:17 | argv | argvLocal.c:110:9:110:11 | * ... | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:105:14:105:17 | argv | argv |
157197
| argvLocal.c:111:15:111:17 | * ... | argvLocal.c:105:14:105:17 | argv | argvLocal.c:111:15:111:17 | * ... | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:105:14:105:17 | argv | argv |
198+
| argvLocal.c:127:9:127:10 | i5 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:127:9:127:10 | i5 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:126:10:126:13 | argv | argv |
199+
| argvLocal.c:128:15:128:16 | i5 | argvLocal.c:126:10:126:13 | argv | argvLocal.c:128:15:128:16 | i5 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:126:10:126:13 | argv | argv |
200+
| argvLocal.c:131:9:131:14 | ... + ... | argvLocal.c:126:10:126:13 | argv | argvLocal.c:131:9:131:14 | ... + ... | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:126:10:126:13 | argv | argv |
201+
| argvLocal.c:132:15:132:20 | ... + ... | argvLocal.c:126:10:126:13 | argv | argvLocal.c:132:15:132:20 | ... + ... | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:126:10:126:13 | argv | argv |
158202
| argvLocal.c:144:9:144:10 | i7 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:144:9:144:10 | i7 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:100:7:100:10 | argv | argv |
159203
| argvLocal.c:145:15:145:16 | i7 | argvLocal.c:100:7:100:10 | argv | argvLocal.c:145:15:145:16 | i7 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:100:7:100:10 | argv | argv |
160204
| argvLocal.c:150:9:150:10 | i8 | argvLocal.c:149:11:149:14 | argv | argvLocal.c:150:9:150:10 | i8 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:149:11:149:14 | argv | argv |

0 commit comments

Comments
 (0)