Skip to content

Commit a36d432

Browse files
committed
C++: Simplify a paragraph and use line numbers in CPP code.
1 parent c04546d commit a36d432

File tree

1 file changed

+8
-1
lines changed

1 file changed

+8
-1
lines changed

docs/codeql/codeql-language-guides/advanced-dataflow-scenarios-cpp.rst

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,7 @@ will catch most things such as:
6262

6363
.. code-block:: cpp
6464
:caption: Example 1
65+
:linenos:
6566
6667
struct A {
6768
const int *p;
@@ -118,6 +119,7 @@ This would match the call to ``write_user_input_to`` in the following example:
118119

119120
.. code-block:: cpp
120121
:caption: Example 2
122+
:linenos:
121123
122124
void write_user_input_to(void*);
123125
void use_value(int);
@@ -204,6 +206,7 @@ Consider a slightly different sink:
204206

205207
.. code-block:: cpp
206208
:caption: Example 3
209+
:linenos:
207210
208211
void write_user_input_to(void*);
209212
void use_pointer(int*);
@@ -295,6 +298,7 @@ Consider an alternative scenario where ``U`` contains a single ``int`` data, and
295298

296299
.. code-block:: cpp
297300
:caption: Example 4
301+
:linenos:
298302
299303
void write_user_input_to(void*);
300304
void use_pointer(int*);
@@ -318,7 +322,9 @@ Consider an alternative scenario where ``U`` contains a single ``int`` data, and
318322
free(u);
319323
}
320324
321-
Since data is no longer a pointer our ``isAdditionalFlowStep`` doesn't make any sense because it specifies flow to the indirection of the field (and an integer does not have any indirections). So there is no choice about whether to taint the value of the field or its indirection: it has to be the value. However, since we pass the address of ``data`` to ``use_pointer`` the tainted data is what is pointed to by the argument of ``use_pointer`` (since the data pointed to by ``&data`` is exactly ``data``). So to handle this case we need a mix of the two situations above:
325+
Since the ``data`` field is now an ``int`` instead of an ``int*`` the field no longer has any indirections, and so the use of ``asIndirectExpr`` in ``isAdditionalFlowStep`` no longer makes sense (and so the additional step will have no results). So there is no choice about whether to taint the value of the field or its indirection: it has to be the value.
326+
327+
However, since we pass the address of ``data`` to ``use_pointer`` on line 12 the tainted value is what is pointed to by the argument of ``use_pointer`` (since the value pointed to by ``&data`` is exactly ``data``). So to handle this case we need a mix of the two situations above:
322328
1. We need to taint the value of the field as described the :ref:`Using asExpr <using-asExpr>` section.
323329
2. We need to select the indirection of the argument as described in the :ref:`Using asIndirectExpr <using-asIndirectExpr>` section.
324330

@@ -373,6 +379,7 @@ To set the stage, consider the following scenario:
373379

374380
.. code-block:: cpp
375381
:caption: Example 5
382+
:linenos:
376383
377384
struct A {
378385
const int *p;

0 commit comments

Comments
 (0)