Skip to content

Commit 503f018

Browse files
MathiasVPMathiasVP
committed
C++: Add taint test with false flow from conflation.
1 parent 91f6498 commit 503f018

File tree

3 files changed

+55
-0
lines changed

3 files changed

+55
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7741,6 +7741,32 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
77417741
| taint.cpp:809:8:809:9 | p2 | taint.cpp:809:7:809:9 | * ... | TAINT |
77427742
| taint.cpp:811:12:811:28 | call to SysAllocStringLen | taint.cpp:812:8:812:9 | p3 | |
77437743
| taint.cpp:812:8:812:9 | p3 | taint.cpp:812:7:812:9 | * ... | TAINT |
7744+
| taint.cpp:817:42:817:46 | p_out | taint.cpp:817:42:817:46 | p_out | |
7745+
| taint.cpp:817:42:817:46 | p_out | taint.cpp:819:4:819:8 | p_out | |
7746+
| taint.cpp:817:62:817:65 | p_in | taint.cpp:817:62:817:65 | p_in | |
7747+
| taint.cpp:817:62:817:65 | p_in | taint.cpp:818:20:818:23 | p_in | |
7748+
| taint.cpp:818:19:818:23 | * ... | taint.cpp:819:19:819:19 | q | |
7749+
| taint.cpp:818:20:818:23 | p_in | taint.cpp:818:19:818:23 | * ... | TAINT |
7750+
| taint.cpp:819:3:819:8 | * ... [post update] | taint.cpp:817:42:817:46 | p_out | |
7751+
| taint.cpp:819:3:819:8 | * ... [post update] | taint.cpp:819:4:819:8 | p_out [inner post update] | |
7752+
| taint.cpp:819:3:819:25 | ... = ... | taint.cpp:819:3:819:8 | * ... [post update] | |
7753+
| taint.cpp:819:4:819:8 | p_out | taint.cpp:819:3:819:8 | * ... | TAINT |
7754+
| taint.cpp:819:12:819:17 | call to strchr | taint.cpp:819:3:819:25 | ... = ... | |
7755+
| taint.cpp:819:19:819:19 | q | taint.cpp:819:12:819:17 | call to strchr | TAINT |
7756+
| taint.cpp:819:22:819:24 | 47 | taint.cpp:819:12:819:17 | call to strchr | TAINT |
7757+
| taint.cpp:822:33:822:35 | out | taint.cpp:822:33:822:35 | out | |
7758+
| taint.cpp:822:33:822:35 | out | taint.cpp:823:27:823:29 | out | |
7759+
| taint.cpp:822:50:822:51 | in | taint.cpp:822:50:822:51 | in | |
7760+
| taint.cpp:822:50:822:51 | in | taint.cpp:823:33:823:34 | in | |
7761+
| taint.cpp:823:26:823:29 | ref arg & ... | taint.cpp:822:33:822:35 | out | |
7762+
| taint.cpp:823:26:823:29 | ref arg & ... | taint.cpp:823:27:823:29 | out [inner post update] | |
7763+
| taint.cpp:823:27:823:29 | out | taint.cpp:823:26:823:29 | & ... | |
7764+
| taint.cpp:823:32:823:34 | ref arg & ... | taint.cpp:822:50:822:51 | in | |
7765+
| taint.cpp:823:32:823:34 | ref arg & ... | taint.cpp:823:33:823:34 | in [inner post update] | |
7766+
| taint.cpp:823:33:823:34 | in | taint.cpp:823:32:823:34 | & ... | |
7767+
| taint.cpp:827:20:827:34 | call to indirect_source | taint.cpp:829:23:829:24 | in | |
7768+
| taint.cpp:828:15:828:17 | out | taint.cpp:829:18:829:20 | out | |
7769+
| taint.cpp:828:15:828:17 | out | taint.cpp:830:8:830:10 | out | |
77447770
| vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 | |
77457771
| vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 | |
77467772
| vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -810,4 +810,22 @@ void test_sysalloc() {
810810

811811
auto p3 = SysAllocStringLen((LPOLESTR)indirect_source(), 10);
812812
sink(*p3); // $ ir MISSING: ast
813+
}
814+
815+
char* strchr(const char*, int);
816+
817+
void write_to_const_ptr_ptr(const char **p_out, const char **p_in) {
818+
const char* q = *p_in;
819+
*p_out = strchr(q, '/');
820+
}
821+
822+
void take_const_ptr(const char *out, const char *in) {
823+
write_to_const_ptr_ptr(&out, &in);
824+
}
825+
826+
void test_write_to_const_ptr_ptr() {
827+
const char* in = indirect_source();
828+
const char* out;
829+
take_const_ptr(out, in);
830+
sink(out); // $ SPURIOUS: ast,ir
813831
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -626,6 +626,11 @@ signatureMatches
626626
| taint.cpp:725:10:725:15 | strtol | (XCHAR *,const XCHAR *,int) | CSimpleStringT | CopyCharsOverlapped | 2 |
627627
| taint.cpp:727:6:727:16 | test_strtol | (char *) | CStringT | CStringT | 0 |
628628
| taint.cpp:785:6:785:15 | fopen_test | (char *) | CStringT | CStringT | 0 |
629+
| taint.cpp:815:7:815:12 | strchr | (LPCOLESTR,int) | CComBSTR | Append | 1 |
630+
| taint.cpp:815:7:815:12 | strchr | (char,int) | CStringT | CStringT | 1 |
631+
| taint.cpp:815:7:815:12 | strchr | (const XCHAR *,int) | CStringT | CStringT | 1 |
632+
| taint.cpp:815:7:815:12 | strchr | (const YCHAR *,int) | CStringT | CStringT | 1 |
633+
| taint.cpp:815:7:815:12 | strchr | (wchar_t,int) | CStringT | CStringT | 1 |
629634
| vector.cpp:333:6:333:35 | vector_iterator_assign_wrapper | (LPCOLESTR,int) | CComBSTR | Append | 1 |
630635
| vector.cpp:333:6:333:35 | vector_iterator_assign_wrapper | (char,int) | CStringT | CStringT | 1 |
631636
| vector.cpp:333:6:333:35 | vector_iterator_assign_wrapper | (const XCHAR *,int) | CStringT | CStringT | 1 |
@@ -2029,6 +2034,12 @@ getParameterTypeName
20292034
| taint.cpp:802:6:802:22 | SysAllocStringLen | 0 | const OLECHAR * |
20302035
| taint.cpp:802:6:802:22 | SysAllocStringLen | 0 | const wchar_t * |
20312036
| taint.cpp:802:6:802:22 | SysAllocStringLen | 1 | unsigned int |
2037+
| taint.cpp:815:7:815:12 | strchr | 0 | const char * |
2038+
| taint.cpp:815:7:815:12 | strchr | 1 | int |
2039+
| taint.cpp:817:6:817:27 | write_to_const_ptr_ptr | 0 | const char ** |
2040+
| taint.cpp:817:6:817:27 | write_to_const_ptr_ptr | 1 | const char ** |
2041+
| taint.cpp:822:6:822:19 | take_const_ptr | 0 | const char * |
2042+
| taint.cpp:822:6:822:19 | take_const_ptr | 1 | const char * |
20322043
| vector.cpp:13:6:13:9 | sink | 0 | int |
20332044
| vector.cpp:14:27:14:30 | sink | 0 | vector> & |
20342045
| vector.cpp:14:27:14:30 | sink | 0 | vector> & |

0 commit comments

Comments
 (0)