Skip to content

Commit c8911ab

Browse files
jbjjbj
committed
C++: Test range-based-for with std::vector too
1 parent 7cc877c commit c8911ab

File tree

4 files changed

+117
-2
lines changed

4 files changed

+117
-2
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -453,6 +453,60 @@
453453
| stl.cpp:252:22:252:28 | const_s | stl.cpp:252:22:252:22 | (__range) | |
454454
| stl.cpp:252:22:252:28 | const_s | stl.cpp:252:22:252:22 | (__range) | |
455455
| stl.cpp:252:22:252:28 | const_s | stl.cpp:252:22:252:22 | call to operator* | TAINT |
456+
| stl.cpp:288:43:288:49 | source1 | stl.cpp:292:21:292:27 | source1 | |
457+
| stl.cpp:288:43:288:49 | source1 | stl.cpp:306:33:306:39 | source1 | |
458+
| stl.cpp:292:21:292:27 | source1 | stl.cpp:292:21:292:28 | call to vector | TAINT |
459+
| stl.cpp:292:21:292:28 | call to vector | stl.cpp:294:14:294:14 | v | |
460+
| stl.cpp:292:21:292:28 | call to vector | stl.cpp:298:38:298:38 | v | |
461+
| stl.cpp:292:21:292:28 | call to vector | stl.cpp:298:55:298:55 | v | |
462+
| stl.cpp:292:21:292:28 | call to vector | stl.cpp:302:15:302:15 | v | |
463+
| stl.cpp:294:14:294:14 | call to begin | stl.cpp:294:14:294:14 | (__begin) | |
464+
| stl.cpp:294:14:294:14 | call to begin | stl.cpp:294:14:294:14 | (__begin) | |
465+
| stl.cpp:294:14:294:14 | call to begin | stl.cpp:294:14:294:14 | (__begin) | |
466+
| stl.cpp:294:14:294:14 | call to end | stl.cpp:294:14:294:14 | (__end) | |
467+
| stl.cpp:294:14:294:14 | call to operator* | stl.cpp:295:8:295:8 | x | |
468+
| stl.cpp:294:14:294:14 | ref arg (__begin) | stl.cpp:294:14:294:14 | (__begin) | |
469+
| stl.cpp:294:14:294:14 | ref arg (__begin) | stl.cpp:294:14:294:14 | (__begin) | |
470+
| stl.cpp:294:14:294:14 | ref arg (__begin) | stl.cpp:294:14:294:14 | (__begin) | |
471+
| stl.cpp:294:14:294:14 | ref arg (__range) | stl.cpp:294:14:294:14 | (__range) | |
472+
| stl.cpp:294:14:294:14 | v | stl.cpp:294:14:294:14 | (__range) | |
473+
| stl.cpp:294:14:294:14 | v | stl.cpp:294:14:294:14 | (__range) | |
474+
| stl.cpp:294:14:294:14 | v | stl.cpp:294:14:294:14 | call to operator* | TAINT |
475+
| stl.cpp:298:38:298:38 | ref arg v | stl.cpp:298:55:298:55 | v | |
476+
| stl.cpp:298:38:298:38 | ref arg v | stl.cpp:302:15:302:15 | v | |
477+
| stl.cpp:298:40:298:44 | call to begin | stl.cpp:298:49:298:50 | it | |
478+
| stl.cpp:298:40:298:44 | call to begin | stl.cpp:298:66:298:67 | it | |
479+
| stl.cpp:298:40:298:44 | call to begin | stl.cpp:299:9:299:10 | it | |
480+
| stl.cpp:298:55:298:55 | ref arg v | stl.cpp:298:55:298:55 | v | |
481+
| stl.cpp:298:55:298:55 | ref arg v | stl.cpp:302:15:302:15 | v | |
482+
| stl.cpp:298:66:298:67 | ref arg it | stl.cpp:298:49:298:50 | it | |
483+
| stl.cpp:298:66:298:67 | ref arg it | stl.cpp:298:66:298:67 | it | |
484+
| stl.cpp:298:66:298:67 | ref arg it | stl.cpp:299:9:299:10 | it | |
485+
| stl.cpp:302:15:302:15 | call to begin | stl.cpp:302:15:302:15 | (__begin) | |
486+
| stl.cpp:302:15:302:15 | call to begin | stl.cpp:302:15:302:15 | (__begin) | |
487+
| stl.cpp:302:15:302:15 | call to begin | stl.cpp:302:15:302:15 | (__begin) | |
488+
| stl.cpp:302:15:302:15 | call to end | stl.cpp:302:15:302:15 | (__end) | |
489+
| stl.cpp:302:15:302:15 | call to operator* | stl.cpp:303:8:303:8 | x | |
490+
| stl.cpp:302:15:302:15 | ref arg (__begin) | stl.cpp:302:15:302:15 | (__begin) | |
491+
| stl.cpp:302:15:302:15 | ref arg (__begin) | stl.cpp:302:15:302:15 | (__begin) | |
492+
| stl.cpp:302:15:302:15 | ref arg (__begin) | stl.cpp:302:15:302:15 | (__begin) | |
493+
| stl.cpp:302:15:302:15 | ref arg (__range) | stl.cpp:302:15:302:15 | (__range) | |
494+
| stl.cpp:302:15:302:15 | v | stl.cpp:302:15:302:15 | (__range) | |
495+
| stl.cpp:302:15:302:15 | v | stl.cpp:302:15:302:15 | (__range) | |
496+
| stl.cpp:302:15:302:15 | v | stl.cpp:302:15:302:15 | call to operator* | TAINT |
497+
| stl.cpp:306:33:306:39 | source1 | stl.cpp:306:33:306:40 | call to vector | TAINT |
498+
| stl.cpp:306:33:306:40 | call to vector | stl.cpp:307:21:307:27 | const_v | |
499+
| stl.cpp:307:21:307:21 | call to begin | stl.cpp:307:21:307:21 | (__begin) | |
500+
| stl.cpp:307:21:307:21 | call to begin | stl.cpp:307:21:307:21 | (__begin) | |
501+
| stl.cpp:307:21:307:21 | call to begin | stl.cpp:307:21:307:21 | (__begin) | |
502+
| stl.cpp:307:21:307:21 | call to end | stl.cpp:307:21:307:21 | (__end) | |
503+
| stl.cpp:307:21:307:21 | call to operator* | stl.cpp:308:8:308:8 | x | |
504+
| stl.cpp:307:21:307:21 | ref arg (__begin) | stl.cpp:307:21:307:21 | (__begin) | |
505+
| stl.cpp:307:21:307:21 | ref arg (__begin) | stl.cpp:307:21:307:21 | (__begin) | |
506+
| stl.cpp:307:21:307:21 | ref arg (__begin) | stl.cpp:307:21:307:21 | (__begin) | |
507+
| stl.cpp:307:21:307:27 | const_v | stl.cpp:307:21:307:21 | (__range) | |
508+
| stl.cpp:307:21:307:27 | const_v | stl.cpp:307:21:307:21 | (__range) | |
509+
| stl.cpp:307:21:307:27 | const_v | stl.cpp:307:21:307:21 | call to operator* | TAINT |
456510
| structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
457511
| structlikeclass.cpp:5:7:5:7 | Unknown literal | structlikeclass.cpp:5:7:5:7 | constructor init of field v | TAINT |
458512
| structlikeclass.cpp:5:7:5:7 | this | structlikeclass.cpp:5:7:5:7 | constructor init of field v [pre-this] | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.cpp

Lines changed: 57 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,7 @@ void test_string_constructors_assignments()
234234

235235
void sink(char) {}
236236

237-
void test_range_based_for_loop() {
237+
void test_range_based_for_loop_string() {
238238
std::string s(source());
239239
for(char c : s) {
240240
sink(c); // tainted [NOT DETECTED by IR]
@@ -252,4 +252,59 @@ void test_range_based_for_loop() {
252252
for(const char& c : const_s) {
253253
sink(c); // tainted [NOT DETECTED by IR]
254254
}
255-
}
255+
}
256+
257+
258+
259+
260+
261+
262+
263+
264+
namespace std {
265+
template <class T>
266+
class vector {
267+
private:
268+
void *data_;
269+
public:
270+
vector(int size);
271+
272+
T& operator[](int idx);
273+
const T& operator[](int idx) const;
274+
275+
typedef std::iterator<random_access_iterator_tag, T> iterator;
276+
typedef std::iterator<random_access_iterator_tag, const T> const_iterator;
277+
278+
iterator begin() noexcept;
279+
iterator end() noexcept;
280+
281+
const_iterator begin() const noexcept;
282+
const_iterator end() const noexcept;
283+
};
284+
}
285+
286+
void sink(int);
287+
288+
void test_range_based_for_loop_vector(int source1) {
289+
// Tainting the vector by allocating a tainted length. This doesn't represent
290+
// how a vector would typically get tainted, but it allows this test to avoid
291+
// being concerned with std::vector modeling.
292+
std::vector<int> v(source1);
293+
294+
for(int x : v) {
295+
sink(x); // tainted [NOT DETECTED by IR]
296+
}
297+
298+
for(std::vector<int>::iterator it = v.begin(); it != v.end(); ++it) {
299+
sink(*it); // tainted [NOT DETECTED]
300+
}
301+
302+
for(int& x : v) {
303+
sink(x); // tainted [NOT DETECTED by IR]
304+
}
305+
306+
const std::vector<int> const_v(source1);
307+
for(const int& x : const_v) {
308+
sink(x); // tainted [NOT DETECTED by IR]
309+
}
310+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,9 @@
5050
| stl.cpp:240:8:240:8 | c | stl.cpp:238:16:238:21 | call to source |
5151
| stl.cpp:248:8:248:8 | c | stl.cpp:238:16:238:21 | call to source |
5252
| stl.cpp:253:8:253:8 | c | stl.cpp:251:28:251:33 | call to source |
53+
| stl.cpp:295:8:295:8 | x | stl.cpp:288:43:288:49 | source1 |
54+
| stl.cpp:303:8:303:8 | x | stl.cpp:288:43:288:49 | source1 |
55+
| stl.cpp:308:8:308:8 | x | stl.cpp:288:43:288:49 | source1 |
5356
| structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
5457
| structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
5558
| structlikeclass.cpp:37:8:37:9 | s3 | structlikeclass.cpp:29:22:29:27 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@
4747
| stl.cpp:240:8:240:8 | stl.cpp:238:16:238:21 | AST only |
4848
| stl.cpp:248:8:248:8 | stl.cpp:238:16:238:21 | AST only |
4949
| stl.cpp:253:8:253:8 | stl.cpp:251:28:251:33 | AST only |
50+
| stl.cpp:295:8:295:8 | stl.cpp:288:43:288:49 | AST only |
51+
| stl.cpp:303:8:303:8 | stl.cpp:288:43:288:49 | AST only |
52+
| stl.cpp:308:8:308:8 | stl.cpp:288:43:288:49 | AST only |
5053
| structlikeclass.cpp:35:8:35:9 | structlikeclass.cpp:29:22:29:27 | AST only |
5154
| structlikeclass.cpp:36:8:36:9 | structlikeclass.cpp:30:24:30:29 | AST only |
5255
| structlikeclass.cpp:37:8:37:9 | structlikeclass.cpp:29:22:29:27 | AST only |

0 commit comments

Comments
 (0)