1
+ using size_t = decltype (sizeof (int ));
2
+
3
+ size_t strlen (const char * str);
4
+ char * strcpy (char * dest, const char * src);
5
+
6
+ namespace Models {
7
+ struct BasicFlow {
8
+ int * tainted;
9
+
10
+ // No model as destructors are excluded from model generation.
11
+ ~BasicFlow () = default ;
12
+
13
+ // summary=Models;BasicFlow;true;returnThis;(int *);;Argument[-1];ReturnValue[*];taint;df-generated
14
+ // contentbased-summary=Models;BasicFlow;true;returnThis;(int *);;Argument[-1];ReturnValue[*];value;dfc-generated
15
+ BasicFlow* returnThis (int * input) {
16
+ return this ;
17
+ }
18
+
19
+ // summary=Models;BasicFlow;true;returnParam0;(int *,int *);;Argument[0];ReturnValue;taint;df-generated
20
+ // summary=Models;BasicFlow;true;returnParam0;(int *,int *);;Argument[*0];ReturnValue[*];taint;df-generated
21
+ // contentbased-summary=Models;BasicFlow;true;returnParam0;(int *,int *);;Argument[0];ReturnValue;value;dfc-generated
22
+ // contentbased-summary=Models;BasicFlow;true;returnParam0;(int *,int *);;Argument[*0];ReturnValue[*];value;dfc-generated
23
+ int * returnParam0 (int * input0, int * input1) {
24
+ return input0;
25
+ }
26
+
27
+ // summary=Models;BasicFlow;true;returnParam1;(int *,int *);;Argument[1];ReturnValue;taint;df-generated
28
+ // summary=Models;BasicFlow;true;returnParam1;(int *,int *);;Argument[*1];ReturnValue[*];taint;df-generated
29
+ // contentbased-summary=Models;BasicFlow;true;returnParam1;(int *,int *);;Argument[1];ReturnValue;value;dfc-generated
30
+ // contentbased-summary=Models;BasicFlow;true;returnParam1;(int *,int *);;Argument[*1];ReturnValue[*];value;dfc-generated
31
+ int * returnParam1 (int * input0, int * input1) {
32
+ return input1;
33
+ }
34
+
35
+ // summary=Models;BasicFlow;true;returnParamMultiple;(bool,int *,int *);;Argument[1];ReturnValue;taint;df-generated
36
+ // summary=Models;BasicFlow;true;returnParamMultiple;(bool,int *,int *);;Argument[*1];ReturnValue[*];taint;df-generated
37
+ // summary=Models;BasicFlow;true;returnParamMultiple;(bool,int *,int *);;Argument[2];ReturnValue;taint;df-generated
38
+ // summary=Models;BasicFlow;true;returnParamMultiple;(bool,int *,int *);;Argument[*2];ReturnValue[*];taint;df-generated
39
+ // contentbased-summary=Models;BasicFlow;true;returnParamMultiple;(bool,int *,int *);;Argument[1];ReturnValue;value;dfc-generated
40
+ // contentbased-summary=Models;BasicFlow;true;returnParamMultiple;(bool,int *,int *);;Argument[*1];ReturnValue[*];value;dfc-generated
41
+ // contentbased-summary=Models;BasicFlow;true;returnParamMultiple;(bool,int *,int *);;Argument[2];ReturnValue;value;dfc-generated
42
+ // contentbased-summary=Models;BasicFlow;true;returnParamMultiple;(bool,int *,int *);;Argument[*2];ReturnValue[*];value;dfc-generated
43
+ int * returnParamMultiple (bool b, int * input0, int * input1) {
44
+ return b ? input0 : input1;
45
+ }
46
+
47
+ // summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[0];Argument[*1];taint;df-generated
48
+ // summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[0];ReturnValue[*];taint;df-generated
49
+ // summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[*0];ReturnValue[*];taint;df-generated
50
+ // summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[1];ReturnValue;taint;df-generated
51
+ // summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[*0];Argument[*1];taint;df-generated
52
+ // contentbased-summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[0];Argument[*1];taint;dfc-generated
53
+ // contentbased-summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[0];ReturnValue[*];taint;dfc-generated
54
+ // contentbased-summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[*0];ReturnValue[*];value;dfc-generated
55
+ // contentbased-summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[1];ReturnValue;value;dfc-generated
56
+ // contentbased-summary=Models;BasicFlow;true;returnSubstring;(const char *,char *);;Argument[*0];Argument[*1];value;dfc-generated
57
+ char * returnSubstring (const char * source, char * dest) {
58
+ return strcpy (dest, source + 1 );
59
+ }
60
+
61
+ // summary=Models;BasicFlow;true;setField;(int *);;Argument[0];Argument[-1];taint;df-generated
62
+ // summary=Models;BasicFlow;true;setField;(int *);;Argument[*0];Argument[-1];taint;df-generated
63
+ // contentbased-summary=Models;BasicFlow;true;setField;(int *);;Argument[0];Argument[-1].Field[*tainted];value;dfc-generated
64
+ // contentbased-summary=Models;BasicFlow;true;setField;(int *);;Argument[*0];Argument[-1].Field[**tainted];value;dfc-generated
65
+ void setField (int * s) {
66
+ tainted = s;
67
+ }
68
+
69
+ // summary=Models;BasicFlow;true;returnField;();;Argument[-1];ReturnValue;taint;df-generated
70
+ // summary=Models;BasicFlow;true;returnField;();;Argument[-1];ReturnValue[*];taint;df-generated
71
+ // contentbased-summary=Models;BasicFlow;true;returnField;();;Argument[-1].Field[*tainted];ReturnValue;value;dfc-generated
72
+ // contentbased-summary=Models;BasicFlow;true;returnField;();;Argument[-1].Field[**tainted];ReturnValue[*];value;dfc-generated
73
+ int * returnField () {
74
+ return tainted;
75
+ }
76
+ };
77
+
78
+ template <typename T>
79
+ struct TemplatedFlow {
80
+ T tainted;
81
+
82
+ // summary=Models;TemplatedFlow<T>;true;template_returnThis;(T);;Argument[-1];ReturnValue[*];taint;df-generated
83
+ // contentbased-summary=Models;TemplatedFlow<T>;true;template_returnThis;(T);;Argument[-1];ReturnValue[*];value;dfc-generated
84
+ TemplatedFlow<T>* template_returnThis (T input) {
85
+ return this ;
86
+ }
87
+
88
+ // summary=Models;TemplatedFlow<T>;true;template_returnParam0;(T *,T *);;Argument[0];ReturnValue;taint;df-generated
89
+ // summary=Models;TemplatedFlow<T>;true;template_returnParam0;(T *,T *);;Argument[*0];ReturnValue[*];taint;df-generated
90
+ // contentbased-summary=Models;TemplatedFlow<T>;true;template_returnParam0;(T *,T *);;Argument[0];ReturnValue;value;dfc-generated
91
+ // contentbased-summary=Models;TemplatedFlow<T>;true;template_returnParam0;(T *,T *);;Argument[*0];ReturnValue[*];value;dfc-generated
92
+ T* template_returnParam0 (T* input0, T* input1) {
93
+ return input0;
94
+ }
95
+
96
+ // summary=Models;TemplatedFlow<T>;true;template_setField;(T);;Argument[0];Argument[-1];taint;df-generated
97
+ // contentbased-summary=Models;TemplatedFlow<T>;true;template_setField;(T);;Argument[0];Argument[-1].Field[*tainted];value;dfc-generated
98
+ void template_setField (T s) {
99
+ tainted = s;
100
+ }
101
+
102
+ // summary=Models;TemplatedFlow<T>;true;template_returnField;();;Argument[-1];ReturnValue[*];taint;df-generated
103
+ // contentbased-summary=Models;TemplatedFlow<T>;true;template_returnField;();;Argument[-1].Field[*tainted];ReturnValue[*];value;dfc-generated
104
+ T& template_returnField () {
105
+ return tainted;
106
+ }
107
+
108
+ // summary=Models;TemplatedFlow<T>;true;templated_function<U>;(U *,T *);;Argument[0];ReturnValue;taint;df-generated
109
+ // summary=Models;TemplatedFlow<T>;true;templated_function<U>;(U *,T *);;Argument[*0];ReturnValue[*];taint;df-generated
110
+ // contentbased-summary=Models;TemplatedFlow<T>;true;templated_function<U>;(U *,T *);;Argument[0];ReturnValue;value;dfc-generated
111
+ // contentbased-summary=Models;TemplatedFlow<T>;true;templated_function<U>;(U *,T *);;Argument[*0];ReturnValue[*];value;dfc-generated
112
+ template <typename U>
113
+ U* templated_function (U* u, T* t) {
114
+ return u;
115
+ }
116
+ };
117
+
118
+ void test_templated_flow () {
119
+ // Ensure that we have an instantiation of the templated class
120
+ TemplatedFlow<int > intFlow;
121
+ intFlow.template_returnThis (0 );
122
+
123
+ intFlow.template_returnParam0 (nullptr , nullptr );
124
+
125
+ intFlow.template_setField (0 );
126
+ intFlow.template_returnField ();
127
+
128
+ intFlow.templated_function <int >(nullptr , nullptr );
129
+ }
130
+ }
0 commit comments