@@ -131,16 +131,23 @@ private class IteratorPointerDereferenceOperator extends Operator, TaintFunction
131
131
/**
132
132
* A non-member `operator++` or `operator--` function for an iterator type.
133
133
*/
134
- private class IteratorCrementOperator extends Operator , DataFlowFunction {
134
+ class IteratorCrementOperator extends Operator {
135
135
FunctionInput iteratorInput ;
136
136
137
137
IteratorCrementOperator ( ) {
138
138
this .hasName ( [ "operator++" , "operator--" ] ) and
139
139
iteratorInput = getIteratorArgumentInput ( this , 0 )
140
140
}
141
141
142
+ /**
143
+ * INTERNAL: Do not use.
144
+ */
145
+ FunctionInput getIteratorInput ( ) { result = iteratorInput }
146
+ }
147
+
148
+ private class IteratorCrementOperatorModel extends IteratorCrementOperator , DataFlowFunction {
142
149
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
143
- input = iteratorInput and
150
+ input = this . getIteratorInput ( ) and
144
151
output .isReturnValue ( )
145
152
or
146
153
input .isParameterDeref ( 0 ) and output .isReturnValueDeref ( )
@@ -150,24 +157,28 @@ private class IteratorCrementOperator extends Operator, DataFlowFunction {
150
157
/**
151
158
* A non-member `operator+` function for an iterator type.
152
159
*/
153
- private class IteratorAddOperator extends Operator , TaintFunction {
160
+ class IteratorAddOperator extends Operator {
154
161
FunctionInput iteratorInput ;
155
162
156
163
IteratorAddOperator ( ) {
157
164
this .hasName ( "operator+" ) and
158
165
iteratorInput = getIteratorArgumentInput ( this , [ 0 , 1 ] )
159
166
}
160
167
168
+ FunctionInput getIteratorInput ( ) { result = iteratorInput }
169
+ }
170
+
171
+ private class IteratorAddOperatorModel extends IteratorAddOperator , TaintFunction {
161
172
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
162
- input = iteratorInput and
173
+ input = this . getIteratorInput ( ) and
163
174
output .isReturnValue ( )
164
175
}
165
176
}
166
177
167
178
/**
168
179
* A non-member `operator-` function that takes a pointer difference type as its second argument.
169
180
*/
170
- private class IteratorSubOperator extends Operator , TaintFunction {
181
+ class IteratorSubOperator extends Operator {
171
182
FunctionInput iteratorInput ;
172
183
173
184
IteratorSubOperator ( ) {
@@ -176,8 +187,12 @@ private class IteratorSubOperator extends Operator, TaintFunction {
176
187
this .getParameter ( 1 ) .getUnspecifiedType ( ) instanceof IntegralType // not an iterator difference
177
188
}
178
189
190
+ FunctionInput getIteratorInput ( ) { result = iteratorInput }
191
+ }
192
+
193
+ private class IteratorSubOperatorModel extends IteratorSubOperator , TaintFunction {
179
194
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
180
- input = iteratorInput and
195
+ input = this . getIteratorInput ( ) and
181
196
output .isReturnValue ( )
182
197
}
183
198
}
@@ -272,11 +287,14 @@ private class IteratorFieldMemberOperator extends Operator, TaintFunction {
272
287
/**
273
288
* An `operator+` or `operator-` member function of an iterator class.
274
289
*/
275
- private class IteratorBinaryArithmeticMemberOperator extends MemberFunction , TaintFunction {
290
+ class IteratorBinaryArithmeticMemberOperator extends MemberFunction {
276
291
IteratorBinaryArithmeticMemberOperator ( ) {
277
292
this .getClassAndName ( [ "operator+" , "operator-" ] ) instanceof Iterator
278
293
}
294
+ }
279
295
296
+ private class IteratorBinaryArithmeticMemberOperatorModel extends IteratorBinaryArithmeticMemberOperator ,
297
+ TaintFunction {
280
298
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
281
299
input .isQualifierObject ( ) and
282
300
output .isReturnValue ( )
@@ -286,12 +304,14 @@ private class IteratorBinaryArithmeticMemberOperator extends MemberFunction, Tai
286
304
/**
287
305
* An `operator+=` or `operator-=` member function of an iterator class.
288
306
*/
289
- private class IteratorAssignArithmeticMemberOperator extends MemberFunction , DataFlowFunction ,
290
- TaintFunction {
307
+ class IteratorAssignArithmeticMemberOperator extends MemberFunction {
291
308
IteratorAssignArithmeticMemberOperator ( ) {
292
309
this .getClassAndName ( [ "operator+=" , "operator-=" ] ) instanceof Iterator
293
310
}
311
+ }
294
312
313
+ private class IteratorAssignArithmeticMemberOperatorModel extends IteratorAssignArithmeticMemberOperator ,
314
+ DataFlowFunction , TaintFunction {
295
315
override predicate hasDataFlow ( FunctionInput input , FunctionOutput output ) {
296
316
input .isQualifierAddress ( ) and
297
317
output .isReturnValue ( )
@@ -326,17 +346,24 @@ private class IteratorArrayMemberOperator extends MemberFunction, TaintFunction,
326
346
/**
327
347
* An `operator=` member function of an iterator class that is not a copy or move assignment
328
348
* operator.
329
- *
330
- * The `hasTaintFlow` override provides flow through output iterators that return themselves with
331
- * `operator*` and use their own `operator=` to assign to the container.
332
349
*/
333
- private class IteratorAssignmentMemberOperator extends MemberFunction , TaintFunction {
350
+ class IteratorAssignmentMemberOperator extends MemberFunction {
334
351
IteratorAssignmentMemberOperator ( ) {
335
352
this .getClassAndName ( "operator=" ) instanceof Iterator and
336
353
not this instanceof CopyAssignmentOperator and
337
354
not this instanceof MoveAssignmentOperator
338
355
}
356
+ }
339
357
358
+ /**
359
+ * An `operator=` member function of an iterator class that is not a copy or move assignment
360
+ * operator.
361
+ *
362
+ * The `hasTaintFlow` override provides flow through output iterators that return themselves with
363
+ * `operator*` and use their own `operator=` to assign to the container.
364
+ */
365
+ private class IteratorAssignmentMemberOperatorModel extends IteratorAssignmentMemberOperator ,
366
+ TaintFunction {
340
367
override predicate hasTaintFlow ( FunctionInput input , FunctionOutput output ) {
341
368
input .isParameterDeref ( 0 ) and
342
369
output .isQualifierObject ( )
0 commit comments