Skip to content

Commit c5bb907

Browse files
MathiasVPMathiasVP
committed
C++: Also handle varargs in MaD parsing.
1 parent c604c44 commit c5bb907

File tree

3 files changed

+37
-10
lines changed

3 files changed

+37
-10
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -491,6 +491,10 @@ string getParameterTypeWithoutTemplateArguments(Function f, int n) {
491491
parseAngles(s, base, _, specifiers) and
492492
result = base + specifiers
493493
)
494+
or
495+
f.isVarargs() and
496+
n = f.getNumberOfParameters() and
497+
result = "..."
494498
}
495499

496500
/**

‎cpp/ql/test/library-tests/dataflow/taint-tests/atl.cpp

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1140,23 +1140,23 @@ void test_CStringT() {
11401140

11411141
CStringT<char> s11;
11421142
s11.AppendFormat("%d", source<int>());
1143-
sink(s11.GetString()); // $ MISSING: ir
1143+
sink(s11.GetString()); // $ ir
11441144

11451145
CStringT<char> s12;
11461146
s12.AppendFormat(indirect_source<char>());
1147-
sink(s12.GetString()); // $ MISSING: ir
1147+
sink(s12.GetString()); // $ ir
11481148

11491149
CStringT<char> s13;
11501150
s13.AppendFormat(source<UINT>());
1151-
sink(s13.GetString()); // $ MISSING: ir
1151+
sink(s13.GetString()); // $ ir
11521152

11531153
CStringT<char> s14;
11541154
s14.AppendFormat(42, source<char>());
1155-
sink(s14.GetString()); // $ MISSING: ir
1155+
sink(s14.GetString()); // $ ir
11561156

11571157
CStringT<char> s15;
11581158
s15.AppendFormat(42, source<char>());
1159-
sink(s15.GetString()); // $ MISSING: ir
1159+
sink(s15.GetString()); // $ ir
11601160

11611161
CStringT<char> s16;
11621162
s16.AppendFormat("%s", indirect_source<char>());

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected

Lines changed: 28 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -208,11 +208,24 @@ signatureMatches
208208
| atl.cpp:1049:3:1049:10 | CStringT | (const YCHAR *,int) | CStringT | CStringT | 1 |
209209
| atl.cpp:1049:3:1049:10 | CStringT | (wchar_t,int) | CStringT | CStringT | 0 |
210210
| atl.cpp:1049:3:1049:10 | CStringT | (wchar_t,int) | CStringT | CStringT | 1 |
211-
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR) | | operator+= | 0 |
212-
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR) | CSimpleStringT | operator+= | 0 |
213-
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR) | CStringT | operator= | 0 |
214-
| atl.cpp:1061:8:1061:19 | AppendFormat | (UINT) | CComBSTR | LoadString | 0 |
215-
| atl.cpp:1061:8:1061:19 | AppendFormat | (UINT) | _U_STRINGorID | _U_STRINGorID | 0 |
211+
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR,...) | CStringT | AppendFormat | 0 |
212+
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR,...) | CStringT | AppendFormat | 1 |
213+
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR,...) | CStringT | Format | 0 |
214+
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR,...) | CStringT | Format | 1 |
215+
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR,...) | CStringT | FormatMessage | 0 |
216+
| atl.cpp:1060:8:1060:19 | AppendFormat | (PCXSTR,...) | CStringT | FormatMessage | 1 |
217+
| atl.cpp:1060:8:1060:19 | AppendFormat | (UINT,...) | CStringT | AppendFormat | 1 |
218+
| atl.cpp:1060:8:1060:19 | AppendFormat | (UINT,...) | CStringT | Format | 1 |
219+
| atl.cpp:1060:8:1060:19 | AppendFormat | (UINT,...) | CStringT | FormatMessage | 1 |
220+
| atl.cpp:1061:8:1061:19 | AppendFormat | (PCXSTR,...) | CStringT | AppendFormat | 1 |
221+
| atl.cpp:1061:8:1061:19 | AppendFormat | (PCXSTR,...) | CStringT | Format | 1 |
222+
| atl.cpp:1061:8:1061:19 | AppendFormat | (PCXSTR,...) | CStringT | FormatMessage | 1 |
223+
| atl.cpp:1061:8:1061:19 | AppendFormat | (UINT,...) | CStringT | AppendFormat | 0 |
224+
| atl.cpp:1061:8:1061:19 | AppendFormat | (UINT,...) | CStringT | AppendFormat | 1 |
225+
| atl.cpp:1061:8:1061:19 | AppendFormat | (UINT,...) | CStringT | Format | 0 |
226+
| atl.cpp:1061:8:1061:19 | AppendFormat | (UINT,...) | CStringT | Format | 1 |
227+
| atl.cpp:1061:8:1061:19 | AppendFormat | (UINT,...) | CStringT | FormatMessage | 0 |
228+
| atl.cpp:1061:8:1061:19 | AppendFormat | (UINT,...) | CStringT | FormatMessage | 1 |
216229
| atl.cpp:1069:7:1069:12 | Insert | (PCXSTR,PCXSTR) | CStringT | Replace | 1 |
217230
| atl.cpp:1069:7:1069:12 | Insert | (const CStringT &,PCXSTR) | | operator+ | 1 |
218231
| atl.cpp:1069:7:1069:12 | Insert | (int,PCXSTR) | CStringT | Insert | 0 |
@@ -867,6 +880,7 @@ getParameterTypeName
867880
| arrayassignment.cpp:88:7:88:9 | get | 0 | int |
868881
| arrayassignment.cpp:90:7:90:16 | operator[] | 0 | int |
869882
| arrayassignment.cpp:124:6:124:9 | sink | 0 | int * |
883+
| atl.cpp:4:8:4:11 | sink | 0 | ... |
870884
| atl.cpp:29:8:29:8 | operator= | 0 | __POSITION && |
871885
| atl.cpp:29:8:29:8 | operator= | 0 | const __POSITION & |
872886
| atl.cpp:51:16:51:16 | operator= | 0 | const tagSAFEARRAYBOUND & |
@@ -1059,7 +1073,9 @@ getParameterTypeName
10591073
| atl.cpp:1049:3:1049:10 | CStringT | 0 | wchar_t |
10601074
| atl.cpp:1049:3:1049:10 | CStringT | 1 | int |
10611075
| atl.cpp:1060:8:1060:19 | AppendFormat | 0 | PCXSTR |
1076+
| atl.cpp:1060:8:1060:19 | AppendFormat | 1 | ... |
10621077
| atl.cpp:1061:8:1061:19 | AppendFormat | 0 | UINT |
1078+
| atl.cpp:1061:8:1061:19 | AppendFormat | 1 | ... |
10631079
| atl.cpp:1069:7:1069:12 | Insert | 0 | int |
10641080
| atl.cpp:1069:7:1069:12 | Insert | 1 | PCXSTR |
10651081
| atl.cpp:1070:7:1070:12 | Insert | 0 | int |
@@ -1123,20 +1139,25 @@ getParameterTypeName
11231139
| format.cpp:5:5:5:12 | snprintf | 0 | char * |
11241140
| format.cpp:5:5:5:12 | snprintf | 1 | size_t |
11251141
| format.cpp:5:5:5:12 | snprintf | 2 | const char * |
1142+
| format.cpp:5:5:5:12 | snprintf | 3 | ... |
11261143
| format.cpp:6:5:6:11 | sprintf | 0 | char * |
11271144
| format.cpp:6:5:6:11 | sprintf | 1 | const char * |
1145+
| format.cpp:6:5:6:11 | sprintf | 2 | ... |
11281146
| format.cpp:7:5:7:12 | swprintf | 0 | wchar_t * |
11291147
| format.cpp:7:5:7:12 | swprintf | 1 | size_t |
11301148
| format.cpp:7:5:7:12 | swprintf | 2 | const wchar_t * |
1149+
| format.cpp:7:5:7:12 | swprintf | 3 | ... |
11311150
| format.cpp:14:5:14:13 | vsnprintf | 0 | char * |
11321151
| format.cpp:14:5:14:13 | vsnprintf | 1 | size_t |
11331152
| format.cpp:14:5:14:13 | vsnprintf | 2 | const char * |
11341153
| format.cpp:14:5:14:13 | vsnprintf | 3 | va_list |
11351154
| format.cpp:16:5:16:13 | mysprintf | 0 | char * |
11361155
| format.cpp:16:5:16:13 | mysprintf | 1 | size_t |
11371156
| format.cpp:16:5:16:13 | mysprintf | 2 | const char * |
1157+
| format.cpp:16:5:16:13 | mysprintf | 3 | ... |
11381158
| format.cpp:28:5:28:10 | sscanf | 0 | const char * |
11391159
| format.cpp:28:5:28:10 | sscanf | 1 | const char * |
1160+
| format.cpp:28:5:28:10 | sscanf | 2 | ... |
11401161
| format.cpp:142:8:142:13 | strlen | 0 | const char * |
11411162
| format.cpp:143:8:143:13 | wcslen | 0 | const wchar_t * |
11421163
| format.cpp:169:6:169:9 | test | 0 | format_string |
@@ -1151,6 +1172,7 @@ getParameterTypeName
11511172
| map.cpp:16:6:16:9 | sink | 0 | unordered_map, hash<char *>, equal_to<char *>, allocator<pair<char *const, pair<int, int>>>> |
11521173
| map.cpp:17:6:17:9 | sink | 0 | iterator |
11531174
| map.cpp:442:7:442:19 | indirect_sink | 0 | int * |
1175+
| movableclass.cpp:3:6:3:9 | sink | 0 | ... |
11541176
| movableclass.cpp:5:7:5:7 | MyMovableClass | 0 | const MyMovableClass & |
11551177
| movableclass.cpp:5:7:5:7 | operator= | 0 | const MyMovableClass & |
11561178
| movableclass.cpp:8:2:8:15 | MyMovableClass | 0 | int |
@@ -1788,6 +1810,7 @@ getParameterTypeName
17881810
| taint.cpp:751:9:751:9 | operator= | 0 | const A & |
17891811
| taint.cpp:758:5:758:11 | sprintf | 0 | char * |
17901812
| taint.cpp:758:5:758:11 | sprintf | 1 | const char * |
1813+
| taint.cpp:758:5:758:11 | sprintf | 2 | ... |
17911814
| taint.cpp:760:6:760:23 | call_sprintf_twice | 0 | char * |
17921815
| taint.cpp:760:6:760:23 | call_sprintf_twice | 1 | char * |
17931816
| taint.cpp:771:8:771:8 | operator= | 0 | TaintInheritingContentObject && |

0 commit comments

Comments
 (0)