Skip to content

Commit ebcecca

Browse files
criemencriemen
authored
Merge pull request github#5157 from geoffw0/modelsbsl2
C++: Improve Iterator models
2 parents a81592d + c07a608 commit ebcecca

File tree

4 files changed

+215
-36
lines changed

4 files changed

+215
-36
lines changed

‎cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll

Lines changed: 35 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import semmle.code.cpp.models.interfaces.Iterator
1515
*/
1616
private class IteratorTraits extends Class {
1717
IteratorTraits() {
18-
this.hasQualifiedName("std", "iterator_traits") and
18+
this.hasQualifiedName(["std", "bsl"], "iterator_traits") and
1919
not this instanceof TemplateClass and
2020
exists(TypedefType t |
2121
this.getAMember() = t and
@@ -26,6 +26,14 @@ private class IteratorTraits extends Class {
2626
Type getIteratorType() { result = this.getTemplateArgument(0) }
2727
}
2828

29+
/**
30+
* A type that is deduced to be an iterator because there is a corresponding
31+
* `std::iterator_traits` instantiation for it.
32+
*/
33+
private class IteratorByTraits extends Iterator {
34+
IteratorByTraits() { exists(IteratorTraits it | it.getIteratorType() = this) }
35+
}
36+
2937
/**
3038
* A type which has the typedefs expected for an iterator.
3139
*/
@@ -36,25 +44,21 @@ private class IteratorByTypedefs extends Iterator, Class {
3644
this.getAMember().(TypedefType).hasName("pointer") and
3745
this.getAMember().(TypedefType).hasName("reference") and
3846
this.getAMember().(TypedefType).hasName("iterator_category") and
39-
not this.hasQualifiedName("std", "iterator_traits")
47+
not this.hasQualifiedName(["std", "bsl"], "iterator_traits")
4048
}
4149
}
4250

4351
/**
4452
* The `std::iterator` class.
4553
*/
4654
private class StdIterator extends Iterator, Class {
47-
StdIterator() { this.hasQualifiedName("std", "iterator") }
55+
StdIterator() { this.hasQualifiedName(["std", "bsl"], "iterator") }
4856
}
4957

5058
/**
51-
* A type that is deduced to be an iterator because there is a corresponding
52-
* `std::iterator_traits` instantiation for it.
59+
* Gets the `FunctionInput` corresponding to an iterator parameter to
60+
* user-defined operator `op`, at `index`.
5361
*/
54-
private class IteratorByTraits extends Iterator {
55-
IteratorByTraits() { exists(IteratorTraits it | it.getIteratorType() = this) }
56-
}
57-
5862
private FunctionInput getIteratorArgumentInput(Operator op, int index) {
5963
exists(Type t |
6064
t =
@@ -155,17 +159,21 @@ private class IteratorSubOperator extends Operator, TaintFunction {
155159
private class IteratorAssignArithmeticOperator extends Operator, DataFlowFunction, TaintFunction {
156160
IteratorAssignArithmeticOperator() {
157161
this.hasName(["operator+=", "operator-="]) and
158-
this.getDeclaringType() instanceof Iterator
162+
exists(getIteratorArgumentInput(this, 0))
159163
}
160164

161165
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
162166
input.isParameter(0) and
163167
output.isReturnValue()
164-
or
165-
input.isParameterDeref(0) and output.isReturnValueDeref()
166168
}
167169

168170
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
171+
input.isParameterDeref(0) and output.isReturnValueDeref()
172+
or
173+
// reverse flow from returned reference to the object referenced by the first parameter
174+
input.isReturnValueDeref() and
175+
output.isParameterDeref(0)
176+
or
169177
input.isParameterDeref(1) and
170178
output.isParameterDeref(0)
171179
}
@@ -177,8 +185,7 @@ private class IteratorAssignArithmeticOperator extends Operator, DataFlowFunctio
177185
class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunction,
178186
IteratorReferenceFunction {
179187
IteratorPointerDereferenceMemberOperator() {
180-
this.hasName("operator*") and
181-
this.getDeclaringType() instanceof Iterator
188+
this.getClassAndName("operator*") instanceof Iterator
182189
}
183190

184191
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -195,8 +202,7 @@ class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunc
195202
*/
196203
private class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunction, TaintFunction {
197204
IteratorCrementMemberOperator() {
198-
this.hasName(["operator++", "operator--"]) and
199-
this.getDeclaringType() instanceof Iterator
205+
this.getClassAndName(["operator++", "operator--"]) instanceof Iterator
200206
}
201207

202208
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -220,10 +226,7 @@ private class IteratorCrementMemberOperator extends MemberFunction, DataFlowFunc
220226
* A member `operator->` function for an iterator type.
221227
*/
222228
private class IteratorFieldMemberOperator extends Operator, TaintFunction {
223-
IteratorFieldMemberOperator() {
224-
this.hasName("operator->") and
225-
this.getDeclaringType() instanceof Iterator
226-
}
229+
IteratorFieldMemberOperator() { this.getClassAndName("operator->") instanceof Iterator }
227230

228231
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
229232
input.isQualifierObject() and
@@ -236,8 +239,7 @@ private class IteratorFieldMemberOperator extends Operator, TaintFunction {
236239
*/
237240
private class IteratorBinaryArithmeticMemberOperator extends MemberFunction, TaintFunction {
238241
IteratorBinaryArithmeticMemberOperator() {
239-
this.hasName(["operator+", "operator-"]) and
240-
this.getDeclaringType() instanceof Iterator
242+
this.getClassAndName(["operator+", "operator-"]) instanceof Iterator
241243
}
242244

243245
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
@@ -252,21 +254,24 @@ private class IteratorBinaryArithmeticMemberOperator extends MemberFunction, Tai
252254
private class IteratorAssignArithmeticMemberOperator extends MemberFunction, DataFlowFunction,
253255
TaintFunction {
254256
IteratorAssignArithmeticMemberOperator() {
255-
this.hasName(["operator+=", "operator-="]) and
256-
this.getDeclaringType() instanceof Iterator
257+
this.getClassAndName(["operator+=", "operator-="]) instanceof Iterator
257258
}
258259

259260
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
260261
input.isQualifierAddress() and
261262
output.isReturnValue()
262-
or
263-
input.isReturnValueDeref() and
264-
output.isQualifierObject()
265263
}
266264

267265
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
268266
input.isQualifierObject() and
269267
output.isReturnValueDeref()
268+
or
269+
// reverse flow from returned reference to the qualifier
270+
input.isReturnValueDeref() and
271+
output.isQualifierObject()
272+
or
273+
input.isParameterDeref(0) and
274+
output.isQualifierObject()
270275
}
271276
}
272277

@@ -275,10 +280,7 @@ private class IteratorAssignArithmeticMemberOperator extends MemberFunction, Dat
275280
*/
276281
private class IteratorArrayMemberOperator extends MemberFunction, TaintFunction,
277282
IteratorReferenceFunction {
278-
IteratorArrayMemberOperator() {
279-
this.hasName("operator[]") and
280-
this.getDeclaringType() instanceof Iterator
281-
}
283+
IteratorArrayMemberOperator() { this.getClassAndName("operator[]") instanceof Iterator }
282284

283285
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
284286
input.isQualifierObject() and
@@ -295,8 +297,7 @@ private class IteratorArrayMemberOperator extends MemberFunction, TaintFunction,
295297
*/
296298
private class IteratorAssignmentMemberOperator extends MemberFunction, TaintFunction {
297299
IteratorAssignmentMemberOperator() {
298-
this.hasName("operator=") and
299-
this.getDeclaringType() instanceof Iterator and
300+
this.getClassAndName("operator=") instanceof Iterator and
300301
not this instanceof CopyAssignmentOperator and
301302
not this instanceof MoveAssignmentOperator
302303
}
@@ -337,7 +338,7 @@ private class BeginOrEndFunction extends MemberFunction, TaintFunction, GetItera
337338
*/
338339
private class InserterIteratorFunction extends GetIteratorFunction {
339340
InserterIteratorFunction() {
340-
this.hasQualifiedName("std", ["front_inserter", "inserter", "back_inserter"])
341+
this.hasQualifiedName(["std", "bsl"], ["front_inserter", "inserter", "back_inserter"])
341342
}
342343

343344
override predicate getsIterator(FunctionInput input, FunctionOutput output) {

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 113 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3197,6 +3197,56 @@
31973197
| standalone_iterators.cpp:90:8:90:8 | call to operator-- | standalone_iterators.cpp:90:5:90:5 | call to operator* | TAINT |
31983198
| standalone_iterators.cpp:90:8:90:8 | ref arg call to operator-- | standalone_iterators.cpp:90:6:90:7 | ref arg i2 | |
31993199
| standalone_iterators.cpp:90:13:90:13 | 0 | standalone_iterators.cpp:90:5:90:5 | ref arg call to operator* | TAINT |
3200+
| standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:101:6:101:7 | c1 | |
3201+
| standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:102:6:102:7 | c1 | |
3202+
| standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:106:6:106:7 | c1 | |
3203+
| standalone_iterators.cpp:98:15:98:16 | call to container | standalone_iterators.cpp:109:7:109:8 | c1 | |
3204+
| standalone_iterators.cpp:101:6:101:7 | c1 | standalone_iterators.cpp:101:9:101:13 | call to begin | TAINT |
3205+
| standalone_iterators.cpp:101:6:101:7 | ref arg c1 | standalone_iterators.cpp:102:6:102:7 | c1 | |
3206+
| standalone_iterators.cpp:101:6:101:7 | ref arg c1 | standalone_iterators.cpp:106:6:106:7 | c1 | |
3207+
| standalone_iterators.cpp:101:6:101:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 | |
3208+
| standalone_iterators.cpp:101:9:101:13 | call to begin | standalone_iterators.cpp:101:2:101:15 | ... = ... | |
3209+
| standalone_iterators.cpp:101:9:101:13 | call to begin | standalone_iterators.cpp:103:3:103:3 | a | |
3210+
| standalone_iterators.cpp:101:9:101:13 | call to begin | standalone_iterators.cpp:104:7:104:7 | a | |
3211+
| standalone_iterators.cpp:102:6:102:7 | c1 | standalone_iterators.cpp:102:9:102:13 | call to begin | TAINT |
3212+
| standalone_iterators.cpp:102:6:102:7 | ref arg c1 | standalone_iterators.cpp:106:6:106:7 | c1 | |
3213+
| standalone_iterators.cpp:102:6:102:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 | |
3214+
| standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:102:2:102:15 | ... = ... | |
3215+
| standalone_iterators.cpp:102:9:102:13 | call to begin | standalone_iterators.cpp:107:7:107:7 | b | |
3216+
| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:103:3:103:3 | ref arg a | TAINT |
3217+
| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:106:6:106:7 | c1 | |
3218+
| standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | standalone_iterators.cpp:109:7:109:8 | c1 | |
3219+
| standalone_iterators.cpp:103:3:103:3 | a | standalone_iterators.cpp:103:2:103:2 | call to operator* | TAINT |
3220+
| standalone_iterators.cpp:103:3:103:3 | ref arg a | standalone_iterators.cpp:104:7:104:7 | a | |
3221+
| standalone_iterators.cpp:103:7:103:12 | call to source | standalone_iterators.cpp:103:2:103:2 | ref arg call to operator* | TAINT |
3222+
| standalone_iterators.cpp:104:7:104:7 | a [post update] | standalone_iterators.cpp:106:6:106:7 | c1 | |
3223+
| standalone_iterators.cpp:104:7:104:7 | a [post update] | standalone_iterators.cpp:109:7:109:8 | c1 | |
3224+
| standalone_iterators.cpp:106:6:106:7 | c1 | standalone_iterators.cpp:106:9:106:13 | call to begin | TAINT |
3225+
| standalone_iterators.cpp:106:6:106:7 | ref arg c1 | standalone_iterators.cpp:109:7:109:8 | c1 | |
3226+
| standalone_iterators.cpp:106:9:106:13 | call to begin | standalone_iterators.cpp:106:2:106:15 | ... = ... | |
3227+
| standalone_iterators.cpp:106:9:106:13 | call to begin | standalone_iterators.cpp:108:7:108:7 | c | |
3228+
| standalone_iterators.cpp:107:7:107:7 | b [post update] | standalone_iterators.cpp:109:7:109:8 | c1 | |
3229+
| standalone_iterators.cpp:108:7:108:7 | c [post update] | standalone_iterators.cpp:109:7:109:8 | c1 | |
3230+
| standalone_iterators.cpp:113:15:113:16 | call to container | standalone_iterators.cpp:116:7:116:8 | c1 | |
3231+
| standalone_iterators.cpp:113:15:113:16 | call to container | standalone_iterators.cpp:122:7:122:8 | c1 | |
3232+
| standalone_iterators.cpp:116:7:116:8 | c1 | standalone_iterators.cpp:116:10:116:14 | call to begin | TAINT |
3233+
| standalone_iterators.cpp:116:7:116:8 | ref arg c1 | standalone_iterators.cpp:122:7:122:8 | c1 | |
3234+
| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:116:2:116:16 | ... = ... | |
3235+
| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:117:7:117:8 | it | |
3236+
| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:118:2:118:3 | it | |
3237+
| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:119:7:119:8 | it | |
3238+
| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:120:2:120:3 | it | |
3239+
| standalone_iterators.cpp:116:10:116:14 | call to begin | standalone_iterators.cpp:121:7:121:8 | it | |
3240+
| standalone_iterators.cpp:117:7:117:8 | it [post update] | standalone_iterators.cpp:122:7:122:8 | c1 | |
3241+
| standalone_iterators.cpp:118:2:118:3 | it | standalone_iterators.cpp:118:5:118:5 | call to operator+= | |
3242+
| standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:119:7:119:8 | it | |
3243+
| standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:120:2:120:3 | it | |
3244+
| standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:121:7:121:8 | it | |
3245+
| standalone_iterators.cpp:118:2:118:3 | ref arg it | standalone_iterators.cpp:122:7:122:8 | c1 | |
3246+
| standalone_iterators.cpp:118:8:118:8 | 1 | standalone_iterators.cpp:118:2:118:3 | ref arg it | TAINT |
3247+
| standalone_iterators.cpp:120:2:120:3 | it | standalone_iterators.cpp:120:5:120:5 | call to operator+= | |
3248+
| standalone_iterators.cpp:120:2:120:3 | ref arg it | standalone_iterators.cpp:121:7:121:8 | it | |
3249+
| standalone_iterators.cpp:120:8:120:13 | call to source | standalone_iterators.cpp:120:2:120:3 | ref arg it | TAINT |
32003250
| stl.h:75:8:75:8 | Unknown literal | stl.h:75:8:75:8 | constructor init of field container | TAINT |
32013251
| stl.h:75:8:75:8 | Unknown literal | stl.h:75:8:75:8 | constructor init of field container | TAINT |
32023252
| stl.h:75:8:75:8 | this | stl.h:75:8:75:8 | constructor init of field container [pre-this] | |
@@ -3876,12 +3926,12 @@
38763926
| string.cpp:408:8:408:9 | i2 | string.cpp:409:10:409:11 | i7 | |
38773927
| string.cpp:409:10:409:11 | i7 | string.cpp:409:12:409:12 | call to operator+= | |
38783928
| string.cpp:409:12:409:12 | call to operator+= | string.cpp:409:8:409:8 | call to operator* | TAINT |
3879-
| string.cpp:409:14:409:14 | 1 | string.cpp:409:12:409:12 | call to operator+= | |
3929+
| string.cpp:409:14:409:14 | 1 | string.cpp:409:10:409:11 | ref arg i7 | TAINT |
38803930
| string.cpp:410:8:410:9 | i2 | string.cpp:410:3:410:9 | ... = ... | |
38813931
| string.cpp:410:8:410:9 | i2 | string.cpp:411:10:411:11 | i8 | |
38823932
| string.cpp:411:10:411:11 | i8 | string.cpp:411:12:411:12 | call to operator-= | |
38833933
| string.cpp:411:12:411:12 | call to operator-= | string.cpp:411:8:411:8 | call to operator* | TAINT |
3884-
| string.cpp:411:14:411:14 | 1 | string.cpp:411:12:411:12 | call to operator-= | |
3934+
| string.cpp:411:14:411:14 | 1 | string.cpp:411:10:411:11 | ref arg i8 | TAINT |
38853935
| string.cpp:413:8:413:9 | s2 | string.cpp:413:11:413:13 | call to end | TAINT |
38863936
| string.cpp:413:11:413:13 | call to end | string.cpp:413:3:413:15 | ... = ... | |
38873937
| string.cpp:413:11:413:13 | call to end | string.cpp:414:5:414:6 | i9 | |
@@ -7496,3 +7546,64 @@
74967546
| vector.cpp:496:25:496:30 | call to source | vector.cpp:496:2:496:3 | ref arg v2 | TAINT |
74977547
| vector.cpp:496:25:496:30 | call to source | vector.cpp:496:5:496:11 | call to emplace | TAINT |
74987548
| vector.cpp:497:7:497:8 | ref arg v2 | vector.cpp:498:1:498:1 | v2 | |
7549+
| vector.cpp:503:18:503:21 | {...} | vector.cpp:506:8:506:9 | as | |
7550+
| vector.cpp:503:18:503:21 | {...} | vector.cpp:507:8:507:9 | as | |
7551+
| vector.cpp:503:18:503:21 | {...} | vector.cpp:509:9:509:10 | as | |
7552+
| vector.cpp:503:18:503:21 | {...} | vector.cpp:515:8:515:9 | as | |
7553+
| vector.cpp:503:20:503:20 | 0 | vector.cpp:503:18:503:21 | {...} | TAINT |
7554+
| vector.cpp:506:8:506:9 | as | vector.cpp:506:8:506:12 | access to array | |
7555+
| vector.cpp:506:11:506:11 | 1 | vector.cpp:506:8:506:12 | access to array | TAINT |
7556+
| vector.cpp:507:8:507:9 | as | vector.cpp:507:8:507:19 | access to array | |
7557+
| vector.cpp:507:11:507:16 | call to source | vector.cpp:507:8:507:19 | access to array | TAINT |
7558+
| vector.cpp:509:9:509:10 | as | vector.cpp:509:3:509:10 | ... = ... | |
7559+
| vector.cpp:509:9:509:10 | as | vector.cpp:510:9:510:11 | ptr | |
7560+
| vector.cpp:509:9:509:10 | as | vector.cpp:511:3:511:5 | ptr | |
7561+
| vector.cpp:510:9:510:11 | ptr | vector.cpp:510:8:510:11 | * ... | TAINT |
7562+
| vector.cpp:511:3:511:5 | ptr | vector.cpp:511:3:511:10 | ... += ... | TAINT |
7563+
| vector.cpp:511:3:511:10 | ... += ... | vector.cpp:512:9:512:11 | ptr | |
7564+
| vector.cpp:511:3:511:10 | ... += ... | vector.cpp:513:3:513:5 | ptr | |
7565+
| vector.cpp:511:10:511:10 | 1 | vector.cpp:511:3:511:10 | ... += ... | TAINT |
7566+
| vector.cpp:512:9:512:11 | ptr | vector.cpp:512:8:512:11 | * ... | TAINT |
7567+
| vector.cpp:513:3:513:5 | ptr | vector.cpp:513:3:513:17 | ... += ... | TAINT |
7568+
| vector.cpp:513:3:513:17 | ... += ... | vector.cpp:514:9:514:11 | ptr | |
7569+
| vector.cpp:513:10:513:15 | call to source | vector.cpp:513:3:513:17 | ... += ... | TAINT |
7570+
| vector.cpp:514:9:514:11 | ptr | vector.cpp:514:8:514:11 | * ... | TAINT |
7571+
| vector.cpp:515:8:515:9 | as | vector.cpp:515:8:515:12 | access to array | |
7572+
| vector.cpp:515:11:515:11 | 1 | vector.cpp:515:8:515:12 | access to array | TAINT |
7573+
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:523:8:523:9 | vs | |
7574+
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:524:8:524:9 | vs | |
7575+
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:526:8:526:9 | vs | |
7576+
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:532:8:532:9 | vs | |
7577+
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:533:2:533:2 | vs | |
7578+
| vector.cpp:520:30:520:30 | 0 | vector.cpp:520:25:520:31 | call to vector | TAINT |
7579+
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:524:8:524:9 | vs | |
7580+
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:526:8:526:9 | vs | |
7581+
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
7582+
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
7583+
| vector.cpp:523:8:523:9 | vs | vector.cpp:523:10:523:10 | call to operator[] | TAINT |
7584+
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:526:8:526:9 | vs | |
7585+
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
7586+
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
7587+
| vector.cpp:524:8:524:9 | vs | vector.cpp:524:10:524:10 | call to operator[] | TAINT |
7588+
| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
7589+
| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
7590+
| vector.cpp:526:8:526:9 | vs | vector.cpp:526:11:526:15 | call to begin | TAINT |
7591+
| vector.cpp:526:11:526:15 | call to begin | vector.cpp:526:3:526:17 | ... = ... | |
7592+
| vector.cpp:526:11:526:15 | call to begin | vector.cpp:527:9:527:10 | it | |
7593+
| vector.cpp:526:11:526:15 | call to begin | vector.cpp:528:3:528:4 | it | |
7594+
| vector.cpp:526:11:526:15 | call to begin | vector.cpp:529:9:529:10 | it | |
7595+
| vector.cpp:526:11:526:15 | call to begin | vector.cpp:530:3:530:4 | it | |
7596+
| vector.cpp:526:11:526:15 | call to begin | vector.cpp:531:9:531:10 | it | |
7597+
| vector.cpp:527:9:527:10 | it | vector.cpp:527:8:527:8 | call to operator* | TAINT |
7598+
| vector.cpp:528:3:528:4 | it | vector.cpp:528:6:528:6 | call to operator+= | |
7599+
| vector.cpp:528:3:528:4 | ref arg it | vector.cpp:529:9:529:10 | it | |
7600+
| vector.cpp:528:3:528:4 | ref arg it | vector.cpp:530:3:530:4 | it | |
7601+
| vector.cpp:528:3:528:4 | ref arg it | vector.cpp:531:9:531:10 | it | |
7602+
| vector.cpp:528:9:528:9 | 1 | vector.cpp:528:3:528:4 | ref arg it | TAINT |
7603+
| vector.cpp:529:9:529:10 | it | vector.cpp:529:8:529:8 | call to operator* | TAINT |
7604+
| vector.cpp:530:3:530:4 | it | vector.cpp:530:6:530:6 | call to operator+= | |
7605+
| vector.cpp:530:3:530:4 | ref arg it | vector.cpp:531:9:531:10 | it | |
7606+
| vector.cpp:530:9:530:14 | call to source | vector.cpp:530:3:530:4 | ref arg it | TAINT |
7607+
| vector.cpp:531:9:531:10 | it | vector.cpp:531:8:531:8 | call to operator* | TAINT |
7608+
| vector.cpp:532:8:532:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
7609+
| vector.cpp:532:8:532:9 | vs | vector.cpp:532:10:532:10 | call to operator[] | TAINT |

0 commit comments

Comments
 (0)