Skip to content

Commit 4a6021f

Browse files
geoffw0geoffw0
committed
C++: Allow equality checking to block taint flow.
1 parent 754d7f0 commit 4a6021f

File tree

3 files changed

+22
-38
lines changed

3 files changed

+22
-38
lines changed

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ private import semmle.code.cpp.ir.dataflow.DataFlow2
55
private import semmle.code.cpp.ir.dataflow.DataFlow3
66
private import semmle.code.cpp.ir.IR
77
private import semmle.code.cpp.ir.dataflow.internal.DataFlowDispatch as Dispatch
8+
private import semmle.code.cpp.controlflow.IRGuards
89
private import semmle.code.cpp.models.interfaces.Taint
910
private import semmle.code.cpp.models.interfaces.DataFlow
1011

@@ -175,6 +176,23 @@ private predicate nodeIsBarrier(DataFlow::Node node) {
175176
readsVariable(node.asInstruction(), checkedVar) and
176177
hasUpperBoundsCheck(checkedVar)
177178
)
179+
or
180+
exists(Variable checkedVar, IRGuardCondition guard, Operand access, Operand other |
181+
/*
182+
* This node is guarded by a condition that forces the accessed variable
183+
* to equal something else. For example:
184+
* ```
185+
* x = taintsource()
186+
* if (x == 10) {
187+
* taintsink(x); // not considered tainted
188+
* }
189+
* ```
190+
*/
191+
192+
readsVariable(node.asInstruction(), checkedVar) and
193+
readsVariable(access.getDef(), checkedVar) and
194+
guard.ensuresEq(access, other, _, node.asInstruction().getBlock(), true)
195+
)
178196
}
179197

180198
private predicate nodeIsBarrierIn(DataFlow::Node node) {

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -59,30 +59,16 @@ edges
5959
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:237:10:237:19 | (size_t)... |
6060
| test.cpp:235:11:235:20 | (size_t)... | test.cpp:214:23:214:23 | s |
6161
| test.cpp:237:10:237:19 | (size_t)... | test.cpp:220:21:220:21 | s |
62-
| test.cpp:241:2:241:32 | Chi | test.cpp:271:17:271:20 | get_size output argument |
6362
| test.cpp:241:2:241:32 | Chi | test.cpp:279:17:279:20 | get_size output argument |
64-
| test.cpp:241:2:241:32 | Chi | test.cpp:287:18:287:21 | get_size output argument |
6563
| test.cpp:241:2:241:32 | Chi | test.cpp:295:18:295:21 | get_size output argument |
6664
| test.cpp:241:18:241:23 | call to getenv | test.cpp:241:2:241:32 | Chi |
6765
| test.cpp:241:18:241:31 | (const char *)... | test.cpp:241:2:241:32 | Chi |
6866
| test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
6967
| test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
70-
| test.cpp:249:20:249:25 | call to getenv | test.cpp:257:11:257:29 | ... * ... |
71-
| test.cpp:249:20:249:25 | call to getenv | test.cpp:257:11:257:29 | ... * ... |
7268
| test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
7369
| test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
74-
| test.cpp:249:20:249:33 | (const char *)... | test.cpp:257:11:257:29 | ... * ... |
75-
| test.cpp:249:20:249:33 | (const char *)... | test.cpp:257:11:257:29 | ... * ... |
76-
| test.cpp:261:19:261:24 | call to getenv | test.cpp:266:10:266:27 | ... * ... |
77-
| test.cpp:261:19:261:24 | call to getenv | test.cpp:266:10:266:27 | ... * ... |
78-
| test.cpp:261:19:261:32 | (const char *)... | test.cpp:266:10:266:27 | ... * ... |
79-
| test.cpp:261:19:261:32 | (const char *)... | test.cpp:266:10:266:27 | ... * ... |
80-
| test.cpp:271:17:271:20 | get_size output argument | test.cpp:273:11:273:28 | ... * ... |
81-
| test.cpp:271:17:271:20 | get_size output argument | test.cpp:273:11:273:28 | ... * ... |
8270
| test.cpp:279:17:279:20 | get_size output argument | test.cpp:281:11:281:28 | ... * ... |
8371
| test.cpp:279:17:279:20 | get_size output argument | test.cpp:281:11:281:28 | ... * ... |
84-
| test.cpp:287:18:287:21 | get_size output argument | test.cpp:290:10:290:27 | ... * ... |
85-
| test.cpp:287:18:287:21 | get_size output argument | test.cpp:290:10:290:27 | ... * ... |
8672
| test.cpp:295:18:295:21 | get_size output argument | test.cpp:298:10:298:27 | ... * ... |
8773
| test.cpp:295:18:295:21 | get_size output argument | test.cpp:298:10:298:27 | ... * ... |
8874
nodes
@@ -156,26 +142,10 @@ nodes
156142
| test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
157143
| test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
158144
| test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
159-
| test.cpp:257:11:257:29 | ... * ... | semmle.label | ... * ... |
160-
| test.cpp:257:11:257:29 | ... * ... | semmle.label | ... * ... |
161-
| test.cpp:257:11:257:29 | ... * ... | semmle.label | ... * ... |
162-
| test.cpp:261:19:261:24 | call to getenv | semmle.label | call to getenv |
163-
| test.cpp:261:19:261:32 | (const char *)... | semmle.label | (const char *)... |
164-
| test.cpp:266:10:266:27 | ... * ... | semmle.label | ... * ... |
165-
| test.cpp:266:10:266:27 | ... * ... | semmle.label | ... * ... |
166-
| test.cpp:266:10:266:27 | ... * ... | semmle.label | ... * ... |
167-
| test.cpp:271:17:271:20 | get_size output argument | semmle.label | get_size output argument |
168-
| test.cpp:273:11:273:28 | ... * ... | semmle.label | ... * ... |
169-
| test.cpp:273:11:273:28 | ... * ... | semmle.label | ... * ... |
170-
| test.cpp:273:11:273:28 | ... * ... | semmle.label | ... * ... |
171145
| test.cpp:279:17:279:20 | get_size output argument | semmle.label | get_size output argument |
172146
| test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
173147
| test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
174148
| test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
175-
| test.cpp:287:18:287:21 | get_size output argument | semmle.label | get_size output argument |
176-
| test.cpp:290:10:290:27 | ... * ... | semmle.label | ... * ... |
177-
| test.cpp:290:10:290:27 | ... * ... | semmle.label | ... * ... |
178-
| test.cpp:290:10:290:27 | ... * ... | semmle.label | ... * ... |
179149
| test.cpp:295:18:295:21 | get_size output argument | semmle.label | get_size output argument |
180150
| test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
181151
| test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
@@ -195,9 +165,5 @@ nodes
195165
| test.cpp:229:2:229:7 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
196166
| test.cpp:231:2:231:7 | call to malloc | test.cpp:201:14:201:19 | call to getenv | test.cpp:231:9:231:24 | call to get_tainted_size | This allocation size is derived from $@ and might overflow | test.cpp:201:14:201:19 | call to getenv | user input (getenv) |
197167
| test.cpp:253:4:253:9 | call to malloc | test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:249:20:249:25 | call to getenv | user input (getenv) |
198-
| test.cpp:257:4:257:9 | call to malloc | test.cpp:249:20:249:25 | call to getenv | test.cpp:257:11:257:29 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:249:20:249:25 | call to getenv | user input (getenv) |
199-
| test.cpp:266:3:266:8 | call to malloc | test.cpp:261:19:261:24 | call to getenv | test.cpp:266:10:266:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:261:19:261:24 | call to getenv | user input (getenv) |
200-
| test.cpp:273:4:273:9 | call to malloc | test.cpp:241:18:241:23 | call to getenv | test.cpp:273:11:273:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:241:18:241:23 | call to getenv | user input (getenv) |
201168
| test.cpp:281:4:281:9 | call to malloc | test.cpp:241:18:241:23 | call to getenv | test.cpp:281:11:281:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:241:18:241:23 | call to getenv | user input (getenv) |
202-
| test.cpp:290:3:290:8 | call to malloc | test.cpp:241:18:241:23 | call to getenv | test.cpp:290:10:290:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:241:18:241:23 | call to getenv | user input (getenv) |
203169
| test.cpp:298:3:298:8 | call to malloc | test.cpp:241:18:241:23 | call to getenv | test.cpp:298:10:298:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:241:18:241:23 | call to getenv | user input (getenv) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -254,7 +254,7 @@ void equality_cases() {
254254
}
255255
if (size2 == 100)
256256
{
257-
malloc(size2 * sizeof(int)); // GOOD [FALSE POSITIVE]
257+
malloc(size2 * sizeof(int)); // GOOD
258258
}
259259
}
260260
{
@@ -263,14 +263,14 @@ void equality_cases() {
263263
if (size != 100)
264264
return;
265265

266-
malloc(size * sizeof(int)); // GOOD [FALSE POSITIVE]
266+
malloc(size * sizeof(int)); // GOOD
267267
}
268268
{
269269
int size;
270270

271271
if ((get_size(size)) && (size == 100))
272272
{
273-
malloc(size * sizeof(int)); // GOOD [FALSE POSITIVE]
273+
malloc(size * sizeof(int)); // GOOD
274274
}
275275
}
276276
{
@@ -287,7 +287,7 @@ void equality_cases() {
287287
if ((!get_size(size)) || (size != 100))
288288
return;
289289

290-
malloc(size * sizeof(int)); // GOOD [FALSE POSITIVE]
290+
malloc(size * sizeof(int)); // GOOD
291291
}
292292
{
293293
int size;

0 commit comments

Comments
 (0)