Skip to content

Commit d77092c

Browse files
geoffw0geoffw0
committed
C++: Add taint tests for strlen.
1 parent 688f540 commit d77092c

File tree

4 files changed

+57
-0
lines changed

4 files changed

+57
-0
lines changed

‎cpp/ql/test/library-tests/dataflow/taint-tests/format.cpp

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,3 +136,24 @@ void test1()
136136
sink(buffer); // tainted [NOT DETECTED]
137137
}
138138
}
139+
140+
// ----------
141+
142+
size_t strlen(const char *s);
143+
size_t wcslen(const wchar_t *s);
144+
145+
void test2()
146+
{
147+
char *s = string::source();
148+
wchar_t *ws = wstring::source();
149+
int i;
150+
151+
sink(strlen(s)); // [FALSE POSITIVE]
152+
sink(wcslen(ws)); // [FALSE POSITIVE]
153+
154+
i = strlen(s) + 1;
155+
sink(i); // [FALSE POSITIVE]
156+
157+
sink(s[strlen(s) - 1]); // tainted
158+
sink(ws + (wcslen(ws) / 2)); // tainted
159+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,31 @@
111111
| format.cpp:135:39:135:45 | ref arg & ... | format.cpp:135:40:135:45 | buffer [inner post update] | |
112112
| format.cpp:135:39:135:45 | ref arg & ... | format.cpp:136:8:136:13 | buffer | |
113113
| format.cpp:135:40:135:45 | buffer | format.cpp:135:39:135:45 | & ... | |
114+
| format.cpp:147:12:147:25 | call to source | format.cpp:151:14:151:14 | s | |
115+
| format.cpp:147:12:147:25 | call to source | format.cpp:154:13:154:13 | s | |
116+
| format.cpp:147:12:147:25 | call to source | format.cpp:157:7:157:7 | s | |
117+
| format.cpp:147:12:147:25 | call to source | format.cpp:157:16:157:16 | s | |
118+
| format.cpp:148:16:148:30 | call to source | format.cpp:152:14:152:15 | ws | |
119+
| format.cpp:148:16:148:30 | call to source | format.cpp:158:7:158:8 | ws | |
120+
| format.cpp:148:16:148:30 | call to source | format.cpp:158:20:158:21 | ws | |
121+
| format.cpp:151:14:151:14 | s | format.cpp:151:7:151:12 | call to strlen | TAINT |
122+
| format.cpp:152:14:152:15 | ws | format.cpp:152:7:152:12 | call to wcslen | TAINT |
123+
| format.cpp:154:6:154:11 | call to strlen | format.cpp:154:6:154:18 | ... + ... | TAINT |
124+
| format.cpp:154:6:154:18 | ... + ... | format.cpp:154:2:154:18 | ... = ... | |
125+
| format.cpp:154:6:154:18 | ... + ... | format.cpp:155:7:155:7 | i | |
126+
| format.cpp:154:13:154:13 | s | format.cpp:154:6:154:11 | call to strlen | TAINT |
127+
| format.cpp:154:18:154:18 | 1 | format.cpp:154:6:154:18 | ... + ... | TAINT |
128+
| format.cpp:157:7:157:7 | s | format.cpp:157:7:157:22 | access to array | TAINT |
129+
| format.cpp:157:9:157:14 | call to strlen | format.cpp:157:9:157:21 | ... - ... | TAINT |
130+
| format.cpp:157:9:157:21 | ... - ... | format.cpp:157:7:157:22 | access to array | TAINT |
131+
| format.cpp:157:16:157:16 | s | format.cpp:157:9:157:14 | call to strlen | TAINT |
132+
| format.cpp:157:21:157:21 | 1 | format.cpp:157:9:157:21 | ... - ... | TAINT |
133+
| format.cpp:158:7:158:8 | ws | format.cpp:158:7:158:27 | ... + ... | TAINT |
134+
| format.cpp:158:7:158:27 | ref arg ... + ... | format.cpp:158:7:158:8 | ws [inner post update] | |
135+
| format.cpp:158:13:158:18 | call to wcslen | format.cpp:158:13:158:26 | ... / ... | TAINT |
136+
| format.cpp:158:13:158:26 | ... / ... | format.cpp:158:7:158:27 | ... + ... | TAINT |
137+
| format.cpp:158:20:158:21 | ws | format.cpp:158:13:158:18 | call to wcslen | TAINT |
138+
| format.cpp:158:26:158:26 | 2 | format.cpp:158:13:158:26 | ... / ... | TAINT |
114139
| stl.cpp:67:12:67:17 | call to source | stl.cpp:71:7:71:7 | a | |
115140
| stl.cpp:68:16:68:20 | 123 | stl.cpp:68:16:68:21 | call to basic_string | TAINT |
116141
| stl.cpp:68:16:68:21 | call to basic_string | stl.cpp:72:7:72:7 | b | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@
88
| format.cpp:100:8:100:13 | buffer | format.cpp:99:30:99:43 | call to source |
99
| format.cpp:105:8:105:13 | buffer | format.cpp:104:31:104:45 | call to source |
1010
| format.cpp:110:8:110:14 | wbuffer | format.cpp:109:38:109:52 | call to source |
11+
| format.cpp:151:7:151:12 | call to strlen | format.cpp:147:12:147:25 | call to source |
12+
| format.cpp:152:7:152:12 | call to wcslen | format.cpp:148:16:148:30 | call to source |
13+
| format.cpp:155:7:155:7 | i | format.cpp:147:12:147:25 | call to source |
14+
| format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
15+
| format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
1116
| stl.cpp:71:7:71:7 | a | stl.cpp:67:12:67:17 | call to source |
1217
| stl.cpp:73:7:73:7 | c | stl.cpp:69:16:69:21 | call to source |
1318
| stl.cpp:75:9:75:13 | call to c_str | stl.cpp:69:16:69:21 | call to source |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
| format.cpp:151:7:151:12 | call to strlen | format.cpp:147:12:147:25 | call to source |
2+
| format.cpp:152:7:152:12 | call to wcslen | format.cpp:148:16:148:30 | call to source |
3+
| format.cpp:155:7:155:7 | i | format.cpp:147:12:147:25 | call to source |
4+
| format.cpp:157:7:157:22 | (int)... | format.cpp:147:12:147:25 | call to source |
5+
| format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
6+
| format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
17
| stl.cpp:71:7:71:7 | (const char *)... | stl.cpp:67:12:67:17 | call to source |
28
| stl.cpp:71:7:71:7 | a | stl.cpp:67:12:67:17 | call to source |
39
| taint.cpp:8:8:8:13 | clean1 | taint.cpp:4:27:4:33 | source1 |

0 commit comments

Comments
 (0)