Skip to content

Commit 1206b73

Browse files
geoffw0geoffw0
committed
Swift: Understand overflow binary arithmetic operations.
1 parent 53f52df commit 1206b73

File tree

6 files changed

+54
-12
lines changed

6 files changed

+54
-12
lines changed

‎swift/ql/lib/codeql/swift/elements/expr/ArithmeticOperation.qll

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,30 +45,33 @@ class BinaryArithmeticOperation extends BinaryExpr {
4545
* An add expression.
4646
* ```
4747
* a + b
48+
* a &+ b
4849
* ```
4950
*/
5051
class AddExpr extends BinaryExpr {
51-
AddExpr() { this.getStaticTarget().getName() = "+(_:_:)" }
52+
AddExpr() { this.getStaticTarget().getName() = ["+(_:_:)", "&+(_:_:)"] }
5253
}
5354

5455
/**
5556
* A subtract expression.
5657
* ```
5758
* a - b
59+
* a &- b
5860
* ```
5961
*/
6062
class SubExpr extends BinaryExpr {
61-
SubExpr() { this.getStaticTarget().getName() = "-(_:_:)" }
63+
SubExpr() { this.getStaticTarget().getName() = ["-(_:_:)", "&-(_:_:)"] }
6264
}
6365

6466
/**
6567
* A multiply expression.
6668
* ```
6769
* a * b
70+
* a &* b
6871
* ```
6972
*/
7073
class MulExpr extends BinaryExpr {
71-
MulExpr() { this.getStaticTarget().getName() = "*(_:_:)" }
74+
MulExpr() { this.getStaticTarget().getName() = ["*(_:_:)", "&*(_:_:)"] }
7275
}
7376

7477
/**

‎swift/ql/test/library-tests/dataflow/taint/core/LocalTaint.expected

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,18 @@
1919
| simple.swift:21:13:21:20 | call to source() | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
2020
| simple.swift:21:24:21:24 | 100 | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
2121
| simple.swift:23:14:23:21 | call to source() | simple.swift:23:13:23:21 | call to -(_:) |
22+
| simple.swift:27:13:27:13 | 1 | simple.swift:27:13:27:25 | ... .&+(_:_:) ... |
23+
| simple.swift:27:18:27:25 | call to source() | simple.swift:27:13:27:25 | ... .&+(_:_:) ... |
24+
| simple.swift:28:13:28:20 | call to source() | simple.swift:28:13:28:25 | ... .&+(_:_:) ... |
25+
| simple.swift:28:25:28:25 | 1 | simple.swift:28:13:28:25 | ... .&+(_:_:) ... |
26+
| simple.swift:29:13:29:13 | 1 | simple.swift:29:13:29:25 | ... .&-(_:_:) ... |
27+
| simple.swift:29:18:29:25 | call to source() | simple.swift:29:13:29:25 | ... .&-(_:_:) ... |
28+
| simple.swift:30:13:30:20 | call to source() | simple.swift:30:13:30:25 | ... .&-(_:_:) ... |
29+
| simple.swift:30:25:30:25 | 1 | simple.swift:30:13:30:25 | ... .&-(_:_:) ... |
30+
| simple.swift:31:13:31:13 | 2 | simple.swift:31:13:31:25 | ... .&*(_:_:) ... |
31+
| simple.swift:31:18:31:25 | call to source() | simple.swift:31:13:31:25 | ... .&*(_:_:) ... |
32+
| simple.swift:32:13:32:20 | call to source() | simple.swift:32:13:32:25 | ... .&*(_:_:) ... |
33+
| simple.swift:32:25:32:25 | 2 | simple.swift:32:13:32:25 | ... .&*(_:_:) ... |
2234
| simple.swift:36:7:36:7 | SSA def(a) | simple.swift:37:13:37:13 | a |
2335
| simple.swift:36:11:36:11 | 0 | simple.swift:36:7:36:7 | SSA def(a) |
2436
| simple.swift:37:13:37:13 | [post] a | simple.swift:38:3:38:3 | a |

‎swift/ql/test/library-tests/dataflow/taint/core/Taint.expected

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ edges
1010
| simple.swift:20:19:20:26 | call to source() : | simple.swift:20:13:20:26 | ... .%(_:_:) ... |
1111
| simple.swift:21:13:21:20 | call to source() : | simple.swift:21:13:21:24 | ... .%(_:_:) ... |
1212
| simple.swift:23:14:23:21 | call to source() : | simple.swift:23:13:23:21 | call to -(_:) |
13+
| simple.swift:27:18:27:25 | call to source() : | simple.swift:27:13:27:25 | ... .&+(_:_:) ... |
14+
| simple.swift:28:13:28:20 | call to source() : | simple.swift:28:13:28:25 | ... .&+(_:_:) ... |
15+
| simple.swift:29:18:29:25 | call to source() : | simple.swift:29:13:29:25 | ... .&-(_:_:) ... |
16+
| simple.swift:30:13:30:20 | call to source() : | simple.swift:30:13:30:25 | ... .&-(_:_:) ... |
17+
| simple.swift:31:18:31:25 | call to source() : | simple.swift:31:13:31:25 | ... .&*(_:_:) ... |
18+
| simple.swift:32:13:32:20 | call to source() : | simple.swift:32:13:32:25 | ... .&*(_:_:) ... |
1319
| simple.swift:40:8:40:15 | call to source() : | simple.swift:41:13:41:13 | a |
1420
| simple.swift:40:8:40:15 | call to source() : | simple.swift:43:13:43:13 | a |
1521
| simple.swift:48:8:48:15 | call to source() : | simple.swift:49:13:49:13 | b |
@@ -48,6 +54,18 @@ nodes
4854
| simple.swift:21:13:21:24 | ... .%(_:_:) ... | semmle.label | ... .%(_:_:) ... |
4955
| simple.swift:23:13:23:21 | call to -(_:) | semmle.label | call to -(_:) |
5056
| simple.swift:23:14:23:21 | call to source() : | semmle.label | call to source() : |
57+
| simple.swift:27:13:27:25 | ... .&+(_:_:) ... | semmle.label | ... .&+(_:_:) ... |
58+
| simple.swift:27:18:27:25 | call to source() : | semmle.label | call to source() : |
59+
| simple.swift:28:13:28:20 | call to source() : | semmle.label | call to source() : |
60+
| simple.swift:28:13:28:25 | ... .&+(_:_:) ... | semmle.label | ... .&+(_:_:) ... |
61+
| simple.swift:29:13:29:25 | ... .&-(_:_:) ... | semmle.label | ... .&-(_:_:) ... |
62+
| simple.swift:29:18:29:25 | call to source() : | semmle.label | call to source() : |
63+
| simple.swift:30:13:30:20 | call to source() : | semmle.label | call to source() : |
64+
| simple.swift:30:13:30:25 | ... .&-(_:_:) ... | semmle.label | ... .&-(_:_:) ... |
65+
| simple.swift:31:13:31:25 | ... .&*(_:_:) ... | semmle.label | ... .&*(_:_:) ... |
66+
| simple.swift:31:18:31:25 | call to source() : | semmle.label | call to source() : |
67+
| simple.swift:32:13:32:20 | call to source() : | semmle.label | call to source() : |
68+
| simple.swift:32:13:32:25 | ... .&*(_:_:) ... | semmle.label | ... .&*(_:_:) ... |
5169
| simple.swift:40:8:40:15 | call to source() : | semmle.label | call to source() : |
5270
| simple.swift:41:13:41:13 | a | semmle.label | a |
5371
| simple.swift:43:13:43:13 | a | semmle.label | a |
@@ -86,6 +104,12 @@ subpaths
86104
| simple.swift:20:13:20:26 | ... .%(_:_:) ... | simple.swift:20:19:20:26 | call to source() : | simple.swift:20:13:20:26 | ... .%(_:_:) ... | result |
87105
| simple.swift:21:13:21:24 | ... .%(_:_:) ... | simple.swift:21:13:21:20 | call to source() : | simple.swift:21:13:21:24 | ... .%(_:_:) ... | result |
88106
| simple.swift:23:13:23:21 | call to -(_:) | simple.swift:23:14:23:21 | call to source() : | simple.swift:23:13:23:21 | call to -(_:) | result |
107+
| simple.swift:27:13:27:25 | ... .&+(_:_:) ... | simple.swift:27:18:27:25 | call to source() : | simple.swift:27:13:27:25 | ... .&+(_:_:) ... | result |
108+
| simple.swift:28:13:28:25 | ... .&+(_:_:) ... | simple.swift:28:13:28:20 | call to source() : | simple.swift:28:13:28:25 | ... .&+(_:_:) ... | result |
109+
| simple.swift:29:13:29:25 | ... .&-(_:_:) ... | simple.swift:29:18:29:25 | call to source() : | simple.swift:29:13:29:25 | ... .&-(_:_:) ... | result |
110+
| simple.swift:30:13:30:25 | ... .&-(_:_:) ... | simple.swift:30:13:30:20 | call to source() : | simple.swift:30:13:30:25 | ... .&-(_:_:) ... | result |
111+
| simple.swift:31:13:31:25 | ... .&*(_:_:) ... | simple.swift:31:18:31:25 | call to source() : | simple.swift:31:13:31:25 | ... .&*(_:_:) ... | result |
112+
| simple.swift:32:13:32:25 | ... .&*(_:_:) ... | simple.swift:32:13:32:20 | call to source() : | simple.swift:32:13:32:25 | ... .&*(_:_:) ... | result |
89113
| simple.swift:41:13:41:13 | a | simple.swift:40:8:40:15 | call to source() : | simple.swift:41:13:41:13 | a | result |
90114
| simple.swift:43:13:43:13 | a | simple.swift:40:8:40:15 | call to source() : | simple.swift:43:13:43:13 | a | result |
91115
| simple.swift:49:13:49:13 | b | simple.swift:48:8:48:15 | call to source() : | simple.swift:49:13:49:13 | b | result |

‎swift/ql/test/library-tests/dataflow/taint/core/simple.swift

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ func taintThroughArithmetic() {
2424

2525
// overflow operators
2626

27-
sink(arg: 1 &+ source()) // $ MISSING: tainted=
28-
sink(arg: source() &+ 1) // $ MISSING: tainted=
29-
sink(arg: 1 &- source()) // $ MISSING: tainted=
30-
sink(arg: source() &- 1) // $ MISSING: tainted=
31-
sink(arg: 2 &* source()) // $ MISSING: tainted=
32-
sink(arg: source() &* 2) // $ MISSING: tainted=
27+
sink(arg: 1 &+ source()) // $ tainted=27
28+
sink(arg: source() &+ 1) // $ tainted=28
29+
sink(arg: 1 &- source()) // $ tainted=29
30+
sink(arg: source() &- 1) // $ tainted=30
31+
sink(arg: 2 &* source()) // $ tainted=31
32+
sink(arg: source() &* 2) // $ tainted=32
3333
}
3434

3535
func taintThroughAssignmentArithmetic() {

‎swift/ql/test/library-tests/elements/expr/arithmeticoperation/arithmeticoperation.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,6 @@
55
| arithmeticoperation.swift:10:6:10:10 | ... .%(_:_:) ... | BinaryArithmeticOperation, RemExpr |
66
| arithmeticoperation.swift:11:6:11:7 | call to -(_:) | UnaryArithmeticOperation, UnaryMinusExpr |
77
| arithmeticoperation.swift:12:6:12:7 | call to +(_:) | UnaryArithmeticOperation, UnaryPlusExpr |
8+
| arithmeticoperation.swift:15:8:15:13 | ... .&+(_:_:) ... | AddExpr, BinaryArithmeticOperation |
9+
| arithmeticoperation.swift:16:8:16:13 | ... .&-(_:_:) ... | BinaryArithmeticOperation, SubExpr |
10+
| arithmeticoperation.swift:17:8:17:13 | ... .&*(_:_:) ... | BinaryArithmeticOperation, MulExpr |

‎swift/ql/test/library-tests/elements/expr/arithmeticoperation/arithmeticoperation.swift

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ func test(c: Bool, x: Int, y: Int, z: Int) {
1212
v = +x;
1313

1414
// arithmetic operations with overflow
15-
v = x &+ y; // NOT DETECTED
16-
v = x &- y; // NOT DETECTED
17-
v = x &* y; // NOT DETECTED
15+
v = x &+ y;
16+
v = x &- y;
17+
v = x &* y;
1818
}

0 commit comments

Comments
 (0)