Skip to content

Commit 88dabff

Browse files
MathiasVPMathiasVP
committed
C++: Add tests that demonstrate flow through custom swap functions
1 parent 06066f0 commit 88dabff

File tree

5 files changed

+178
-0
lines changed

5 files changed

+178
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -623,3 +623,78 @@
623623
| taint.cpp:483:18:483:19 | ref arg & ... | taint.cpp:483:19:483:19 | n [inner post update] | |
624624
| taint.cpp:483:19:483:19 | n | taint.cpp:483:18:483:19 | & ... | |
625625
| taint.cpp:483:28:483:34 | source1 | taint.cpp:483:11:483:15 | ref arg & ... | TAINT |
626+
| taint.cpp:502:3:502:7 | this | taint.cpp:502:30:502:44 | constructor init of field data [pre-this] | |
627+
| taint.cpp:502:22:502:25 | that | taint.cpp:502:35:502:38 | that | |
628+
| taint.cpp:502:40:502:43 | data | taint.cpp:502:30:502:44 | constructor init of field data | TAINT |
629+
| taint.cpp:502:40:502:43 | data | taint.cpp:502:40:502:43 | data | |
630+
| taint.cpp:504:10:504:18 | this | taint.cpp:507:4:507:7 | this | |
631+
| taint.cpp:504:33:504:36 | that | taint.cpp:506:15:506:18 | that | |
632+
| taint.cpp:506:14:506:18 | call to Class | taint.cpp:507:9:507:11 | tmp | |
633+
| taint.cpp:507:4:507:7 | ref arg this | taint.cpp:508:12:508:15 | this | |
634+
| taint.cpp:507:4:507:7 | this | taint.cpp:508:12:508:15 | this | |
635+
| taint.cpp:508:12:508:15 | this | taint.cpp:508:11:508:15 | * ... | TAINT |
636+
| taint.cpp:511:10:511:18 | this | taint.cpp:512:4:512:7 | this | |
637+
| taint.cpp:511:28:511:31 | that | taint.cpp:511:28:511:31 | that | |
638+
| taint.cpp:511:28:511:31 | that | taint.cpp:512:9:512:12 | that | |
639+
| taint.cpp:512:4:512:7 | ref arg this | taint.cpp:513:12:513:15 | this | |
640+
| taint.cpp:512:4:512:7 | this | taint.cpp:513:12:513:15 | this | |
641+
| taint.cpp:512:9:512:12 | ref arg that | taint.cpp:511:28:511:31 | that | |
642+
| taint.cpp:513:12:513:15 | this | taint.cpp:513:11:513:15 | * ... | TAINT |
643+
| taint.cpp:516:8:516:11 | this | taint.cpp:519:9:519:12 | this | |
644+
| taint.cpp:516:20:516:23 | that | taint.cpp:516:20:516:23 | that | |
645+
| taint.cpp:516:20:516:23 | that | taint.cpp:519:15:519:18 | that | |
646+
| taint.cpp:519:9:519:12 | data | taint.cpp:519:20:519:23 | ref arg data | |
647+
| taint.cpp:519:15:519:18 | that | taint.cpp:519:9:519:12 | ref arg data | |
648+
| taint.cpp:519:15:519:18 | that [post update] | taint.cpp:516:20:516:23 | that | |
649+
| taint.cpp:519:20:519:23 | data | taint.cpp:519:9:519:12 | ref arg data | |
650+
| taint.cpp:524:19:524:19 | x | taint.cpp:524:19:524:19 | x | |
651+
| taint.cpp:524:19:524:19 | x | taint.cpp:525:3:525:3 | x | |
652+
| taint.cpp:524:29:524:29 | y | taint.cpp:524:29:524:29 | y | |
653+
| taint.cpp:524:29:524:29 | y | taint.cpp:525:10:525:10 | y | |
654+
| taint.cpp:525:3:525:3 | ref arg x | taint.cpp:524:19:524:19 | x | |
655+
| taint.cpp:525:10:525:10 | ref arg y | taint.cpp:524:29:524:29 | y | |
656+
| taint.cpp:532:20:532:20 | x | taint.cpp:534:2:534:2 | x | |
657+
| taint.cpp:532:20:532:20 | x | taint.cpp:536:7:536:7 | x | |
658+
| taint.cpp:532:20:532:20 | x | taint.cpp:539:6:539:6 | x | |
659+
| taint.cpp:532:20:532:20 | x | taint.cpp:542:7:542:7 | x | |
660+
| taint.cpp:533:20:533:20 | y | taint.cpp:537:7:537:7 | y | |
661+
| taint.cpp:533:20:533:20 | y | taint.cpp:539:2:539:2 | y | |
662+
| taint.cpp:533:20:533:20 | y | taint.cpp:541:7:541:7 | y | |
663+
| taint.cpp:534:2:534:2 | x [post update] | taint.cpp:536:7:536:7 | x | |
664+
| taint.cpp:534:2:534:2 | x [post update] | taint.cpp:539:6:539:6 | x | |
665+
| taint.cpp:534:2:534:2 | x [post update] | taint.cpp:542:7:542:7 | x | |
666+
| taint.cpp:534:2:534:18 | ... = ... | taint.cpp:536:9:536:12 | data | |
667+
| taint.cpp:534:2:534:18 | ... = ... | taint.cpp:542:9:542:12 | data | |
668+
| taint.cpp:534:11:534:16 | call to source | taint.cpp:534:2:534:18 | ... = ... | |
669+
| taint.cpp:539:2:539:2 | ref arg y | taint.cpp:541:7:541:7 | y | |
670+
| taint.cpp:544:20:544:21 | z1 | taint.cpp:545:2:545:3 | z1 | |
671+
| taint.cpp:544:20:544:21 | z1 | taint.cpp:546:7:546:8 | z1 | |
672+
| taint.cpp:544:20:544:21 | z1 | taint.cpp:548:7:548:8 | z1 | |
673+
| taint.cpp:544:20:544:21 | z1 | taint.cpp:551:7:551:8 | z1 | |
674+
| taint.cpp:544:24:544:25 | z2 | taint.cpp:548:11:548:12 | z2 | |
675+
| taint.cpp:544:24:544:25 | z2 | taint.cpp:550:7:550:8 | z2 | |
676+
| taint.cpp:545:2:545:3 | z1 [post update] | taint.cpp:546:7:546:8 | z1 | |
677+
| taint.cpp:545:2:545:3 | z1 [post update] | taint.cpp:548:7:548:8 | z1 | |
678+
| taint.cpp:545:2:545:3 | z1 [post update] | taint.cpp:551:7:551:8 | z1 | |
679+
| taint.cpp:545:2:545:19 | ... = ... | taint.cpp:546:10:546:13 | data | |
680+
| taint.cpp:545:2:545:19 | ... = ... | taint.cpp:551:10:551:13 | data | |
681+
| taint.cpp:545:12:545:17 | call to source | taint.cpp:545:2:545:19 | ... = ... | |
682+
| taint.cpp:548:7:548:8 | ref arg z1 | taint.cpp:551:7:551:8 | z1 | |
683+
| taint.cpp:548:11:548:12 | ref arg z2 | taint.cpp:550:7:550:8 | z2 | |
684+
| taint.cpp:556:20:556:20 | x | taint.cpp:558:2:558:2 | x | |
685+
| taint.cpp:556:20:556:20 | x | taint.cpp:560:7:560:7 | x | |
686+
| taint.cpp:556:20:556:20 | x | taint.cpp:563:16:563:16 | x | |
687+
| taint.cpp:556:20:556:20 | x | taint.cpp:566:7:566:7 | x | |
688+
| taint.cpp:557:20:557:20 | y | taint.cpp:561:7:561:7 | y | |
689+
| taint.cpp:557:20:557:20 | y | taint.cpp:563:2:563:2 | y | |
690+
| taint.cpp:557:20:557:20 | y | taint.cpp:565:7:565:7 | y | |
691+
| taint.cpp:558:2:558:2 | x [post update] | taint.cpp:560:7:560:7 | x | |
692+
| taint.cpp:558:2:558:2 | x [post update] | taint.cpp:563:16:563:16 | x | |
693+
| taint.cpp:558:2:558:2 | x [post update] | taint.cpp:566:7:566:7 | x | |
694+
| taint.cpp:558:2:558:18 | ... = ... | taint.cpp:560:9:560:12 | data | |
695+
| taint.cpp:558:2:558:18 | ... = ... | taint.cpp:566:9:566:12 | data | |
696+
| taint.cpp:558:11:558:16 | call to source | taint.cpp:558:2:558:18 | ... = ... | |
697+
| taint.cpp:563:2:563:2 | ref arg y | taint.cpp:565:7:565:7 | y | |
698+
| taint.cpp:563:6:563:14 | ref arg call to move | taint.cpp:563:16:563:16 | x [inner post update] | |
699+
| taint.cpp:563:6:563:14 | ref arg call to move | taint.cpp:566:7:566:7 | x | |
700+
| taint.cpp:563:16:563:16 | x | taint.cpp:563:6:563:14 | call to move | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -483,4 +483,85 @@ void test_getdelim(FILE* source1) {
483483
getdelim(&line, &n, '\n', source1);
484484

485485
sink(line);
486+
}
487+
488+
namespace std
489+
{
490+
template <class T>
491+
T &&move(T &t) noexcept; // simplified signature
492+
}
493+
494+
namespace IntWrapper
495+
{
496+
struct Class
497+
{
498+
int data;
499+
500+
Class() = default;
501+
502+
Class(const Class &that) : data(that.data) {}
503+
504+
Class &operator=(const Class &that)
505+
{
506+
auto tmp = that;
507+
swap(tmp);
508+
return *this;
509+
}
510+
511+
Class& operator=(Class&& that) {
512+
swap(that);
513+
return *this;
514+
}
515+
516+
void swap(Class &that) noexcept
517+
{
518+
using std::swap;
519+
swap(data, that.data);
520+
}
521+
};
522+
523+
// For ADL
524+
void swap(Class &x, Class &y) {
525+
x.swap(y);
526+
}
527+
} // namespace ImplementationDetails
528+
529+
// using std::swap;
530+
531+
void test_copy_assignment_operator() {
532+
IntWrapper::Class x;
533+
IntWrapper::Class y;
534+
x.data = source();
535+
536+
sink(x.data); // tainted
537+
sink(y.data); // clean
538+
539+
y = x;
540+
541+
sink(y.data); // tainted [FALSE NEGATIVE in IR]
542+
sink(x.data); // tainted
543+
544+
IntWrapper::Class z1, z2;
545+
z1.data = source();
546+
sink(z1.data); // tainted
547+
548+
swap(z1, z2);
549+
550+
sink(z2.data); // tainted
551+
sink(z1.data); // clean [FALSE POSITIVE]
552+
}
553+
554+
void test_move_assignment_operator()
555+
{
556+
IntWrapper::Class x;
557+
IntWrapper::Class y;
558+
x.data = source();
559+
560+
sink(x.data); // tainted
561+
sink(y.data); // clean
562+
563+
y = std::move(x);
564+
565+
sink(y.data); // tainted [FALSE NEGATIVE in IR]
566+
sink(x.data); // tainted
486567
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,3 +70,14 @@
7070
| taint.cpp:470:7:470:7 | x | taint.cpp:462:6:462:11 | call to source |
7171
| taint.cpp:471:7:471:7 | y | taint.cpp:462:6:462:11 | call to source |
7272
| taint.cpp:485:7:485:10 | line | taint.cpp:480:26:480:32 | source1 |
73+
| taint.cpp:536:9:536:12 | data | taint.cpp:534:11:534:16 | call to source |
74+
| taint.cpp:541:9:541:12 | data | taint.cpp:534:11:534:16 | call to source |
75+
| taint.cpp:542:9:542:12 | data | taint.cpp:534:11:534:16 | call to source |
76+
| taint.cpp:546:10:546:13 | data | taint.cpp:545:12:545:17 | call to source |
77+
| taint.cpp:550:10:550:13 | data | taint.cpp:545:12:545:17 | call to source |
78+
| taint.cpp:551:10:551:13 | data | taint.cpp:544:24:544:25 | z2 |
79+
| taint.cpp:551:10:551:13 | data | taint.cpp:545:12:545:17 | call to source |
80+
| taint.cpp:560:9:560:12 | data | taint.cpp:558:11:558:16 | call to source |
81+
| taint.cpp:565:9:565:12 | data | taint.cpp:556:20:556:20 | x |
82+
| taint.cpp:565:9:565:12 | data | taint.cpp:558:11:558:16 | call to source |
83+
| taint.cpp:566:9:566:12 | data | taint.cpp:558:11:558:16 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,3 +45,7 @@
4545
| taint.cpp:446:7:446:7 | taint.cpp:445:14:445:28 | AST only |
4646
| taint.cpp:447:9:447:17 | taint.cpp:445:14:445:28 | AST only |
4747
| taint.cpp:471:7:471:7 | taint.cpp:462:6:462:11 | AST only |
48+
| taint.cpp:541:9:541:12 | taint.cpp:534:11:534:16 | AST only |
49+
| taint.cpp:551:10:551:13 | taint.cpp:544:24:544:25 | AST only |
50+
| taint.cpp:565:9:565:12 | taint.cpp:556:20:556:20 | AST only |
51+
| taint.cpp:565:9:565:12 | taint.cpp:558:11:558:16 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,10 @@
3737
| taint.cpp:465:7:465:7 | x | taint.cpp:462:6:462:11 | call to source |
3838
| taint.cpp:470:7:470:7 | x | taint.cpp:462:6:462:11 | call to source |
3939
| taint.cpp:485:7:485:10 | line | taint.cpp:480:26:480:32 | source1 |
40+
| taint.cpp:536:9:536:12 | data | taint.cpp:534:11:534:16 | call to source |
41+
| taint.cpp:542:9:542:12 | data | taint.cpp:534:11:534:16 | call to source |
42+
| taint.cpp:546:10:546:13 | data | taint.cpp:545:12:545:17 | call to source |
43+
| taint.cpp:550:10:550:13 | data | taint.cpp:545:12:545:17 | call to source |
44+
| taint.cpp:551:10:551:13 | data | taint.cpp:545:12:545:17 | call to source |
45+
| taint.cpp:560:9:560:12 | data | taint.cpp:558:11:558:16 | call to source |
46+
| taint.cpp:566:9:566:12 | data | taint.cpp:558:11:558:16 | call to source |

0 commit comments

Comments
 (0)