step-31

Author: xcorail

courses/cpp/uboot/answers/31_taint_tracking.ql

@@ -0,0 +1,31 @@
+/**
+* @kind path-problem
+*/
+
+import cpp
+import semmle.code.cpp.dataflow.TaintTracking
+import DataFlow::PathGraph
+ 
+class NetworkRead extends Expr {
+  NetworkRead() {
+      exists(MacroInvocation i | this = i.getExpr()
+        and i.getMacroName().regexpMatch("ntoh(l|ll|s)"))
+  }
+}
+
+class Config extends TaintTracking::Configuration {
+  Config() { this = "NetworkToMemFuncLength" }
+ 
+  override predicate isSource(DataFlow::Node source) {
+      source.asExpr() instanceof NetworkRead
+  }
+ 
+  override predicate isSink(DataFlow::Node sink) {
+    exists (FunctionCall fc |
+        sink.asExpr() = fc.getArgument(2) and fc.getTarget().getName()= "memcpy")
+  }
+}
+
+from Config cfg, DataFlow::PathNode source, DataFlow::PathNode sink
+where cfg.hasFlowPath(source, sink)
+select sink, source, sink, "ntoh flows to memcpy"

courses/cpp/uboot/image/config/config.json

@@ -8,6 +8,7 @@
     "21_memcpy_calls.ql": "step-21.csv",
     "22_macro_invocations.ql": "step-22.csv",
     "23_macro_expressions.ql": "step_23.csv",
-    "24_class_network_reads.ql": "step-24.csv"
+    "24_class_network_reads.ql": "step-24.csv",
+    "31_taint_tracking": false
   }
 }