Skip to content

Commit a35dc7e

Browse files
MathiasVPMathiasVP
authored
Merge pull request #18463 from MathiasVP/add-sysalloc-models
C++: Add MaD models for `SysAllocString` and friends
2 parents 039b2ec + 1822dc4 commit a35dc7e

File tree

6 files changed

+52
-5
lines changed

6 files changed

+52
-5
lines changed

‎cpp/ql/lib/ext/oleauto.model.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: summaryModel
5+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
6+
- ["", "", False, "SysAllocString", "", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
7+
- ["", "", False, "SysAllocStringByteLen", "", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]
8+
- ["", "", False, "SysAllocStringLen", "", "", "Argument[*0]", "ReturnValue[*]", "value", "manual"]

‎cpp/ql/src/change-notes/2025-01-09-SysAllocString.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added dataflow models for `SysAllocString` and related functions.

‎cpp/ql/test/library-tests/dataflow/external-models/flow.expected

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,14 @@ edges
1010
| asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | *send_buffer | provenance | Sink:MaD:6 |
1111
| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | provenance | |
1212
| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:10 |
13-
| test.cpp:4:5:4:11 | [summary param] 0 in ymlStep | test.cpp:4:5:4:11 | [summary] to write: ReturnValue in ymlStep | provenance | MaD:966 |
14-
| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:7:10:7:18 | call to ymlSource | provenance | Src:MaD:964 |
15-
| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:11:10:11:10 | x | provenance | Sink:MaD:965 |
13+
| test.cpp:4:5:4:11 | [summary param] 0 in ymlStep | test.cpp:4:5:4:11 | [summary] to write: ReturnValue in ymlStep | provenance | MaD:969 |
14+
| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:7:10:7:18 | call to ymlSource | provenance | Src:MaD:967 |
15+
| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:11:10:11:10 | x | provenance | Sink:MaD:968 |
1616
| test.cpp:7:10:7:18 | call to ymlSource | test.cpp:13:18:13:18 | x | provenance | |
1717
| test.cpp:13:10:13:16 | call to ymlStep | test.cpp:13:10:13:16 | call to ymlStep | provenance | |
18-
| test.cpp:13:10:13:16 | call to ymlStep | test.cpp:15:10:15:10 | y | provenance | Sink:MaD:965 |
18+
| test.cpp:13:10:13:16 | call to ymlStep | test.cpp:15:10:15:10 | y | provenance | Sink:MaD:968 |
1919
| test.cpp:13:18:13:18 | x | test.cpp:4:5:4:11 | [summary param] 0 in ymlStep | provenance | |
20-
| test.cpp:13:18:13:18 | x | test.cpp:13:10:13:16 | call to ymlStep | provenance | MaD:966 |
20+
| test.cpp:13:18:13:18 | x | test.cpp:13:10:13:16 | call to ymlStep | provenance | MaD:969 |
2121
nodes
2222
| asio_streams.cpp:56:18:56:23 | [summary param] *0 in buffer | semmle.label | [summary param] *0 in buffer |
2323
| asio_streams.cpp:56:18:56:23 | [summary] to write: ReturnValue in buffer | semmle.label | [summary] to write: ReturnValue in buffer |

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7735,6 +7735,12 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
77357735
| taint.cpp:790:10:790:12 | ref arg & ... | taint.cpp:790:11:790:12 | f2 [inner post update] | |
77367736
| taint.cpp:790:10:790:12 | ref arg & ... | taint.cpp:791:7:791:8 | f2 | |
77377737
| taint.cpp:790:11:790:12 | f2 | taint.cpp:790:10:790:12 | & ... | |
7738+
| taint.cpp:805:12:805:25 | call to SysAllocString | taint.cpp:806:8:806:9 | p1 | |
7739+
| taint.cpp:806:8:806:9 | p1 | taint.cpp:806:7:806:9 | * ... | TAINT |
7740+
| taint.cpp:808:12:808:32 | call to SysAllocStringByteLen | taint.cpp:809:8:809:9 | p2 | |
7741+
| taint.cpp:809:8:809:9 | p2 | taint.cpp:809:7:809:9 | * ... | TAINT |
7742+
| taint.cpp:811:12:811:28 | call to SysAllocStringLen | taint.cpp:812:8:812:9 | p3 | |
7743+
| taint.cpp:812:8:812:9 | p3 | taint.cpp:812:7:812:9 | * ... | TAINT |
77387744
| vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 | |
77397745
| vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 | |
77407746
| vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -789,4 +789,25 @@ void fopen_test(char* source) {
789789
FILE* f2;
790790
fopen_s(&f2, source, "r");
791791
sink(f2); // $ ast,ir
792+
}
793+
794+
typedef wchar_t OLECHAR;
795+
typedef OLECHAR* LPOLESTR;
796+
typedef const LPOLESTR LPCOLESTR;
797+
typedef OLECHAR* BSTR;
798+
typedef const char* LPCSTR;
799+
800+
BSTR SysAllocString(const OLECHAR *);
801+
BSTR SysAllocStringByteLen(LPCSTR, unsigned );
802+
BSTR SysAllocStringLen(const OLECHAR *,unsigned);
803+
804+
void test_sysalloc() {
805+
auto p1 = SysAllocString((LPOLESTR)indirect_source());
806+
sink(*p1); // $ ir MISSING: ast
807+
808+
auto p2 = SysAllocStringByteLen(indirect_source(), 10);
809+
sink(*p2); // $ ir MISSING: ast
810+
811+
auto p3 = SysAllocStringLen((LPOLESTR)indirect_source(), 10);
812+
sink(*p3); // $ ir MISSING: ast
792813
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2021,6 +2021,14 @@ getParameterTypeName
20212021
| taint.cpp:783:5:783:11 | fopen_s | 1 | const char * |
20222022
| taint.cpp:783:5:783:11 | fopen_s | 2 | const char * |
20232023
| taint.cpp:785:6:785:15 | fopen_test | 0 | char * |
2024+
| taint.cpp:800:6:800:19 | SysAllocString | 0 | const OLECHAR * |
2025+
| taint.cpp:800:6:800:19 | SysAllocString | 0 | const wchar_t * |
2026+
| taint.cpp:801:6:801:26 | SysAllocStringByteLen | 0 | LPCSTR |
2027+
| taint.cpp:801:6:801:26 | SysAllocStringByteLen | 0 | const char * |
2028+
| taint.cpp:801:6:801:26 | SysAllocStringByteLen | 1 | unsigned int |
2029+
| taint.cpp:802:6:802:22 | SysAllocStringLen | 0 | const OLECHAR * |
2030+
| taint.cpp:802:6:802:22 | SysAllocStringLen | 0 | const wchar_t * |
2031+
| taint.cpp:802:6:802:22 | SysAllocStringLen | 1 | unsigned int |
20242032
| vector.cpp:13:6:13:9 | sink | 0 | int |
20252033
| vector.cpp:14:27:14:30 | sink | 0 | vector> & |
20262034
| vector.cpp:14:27:14:30 | sink | 0 | vector> & |

0 commit comments

Comments
 (0)