Skip to content

Commit 78068a4

Browse files
paldepindpaldepind
committed
C++: Make realloc a data-flow function
1 parent ffab199 commit 78068a4

File tree

3 files changed

+51
-35
lines changed

3 files changed

+51
-35
lines changed

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@
55
*/
66

77
import semmle.code.cpp.models.interfaces.Allocation
8-
import semmle.code.cpp.models.interfaces.Taint
8+
import semmle.code.cpp.models.interfaces.DataFlow
99

1010
/**
1111
* An allocation function (such as `realloc`) that has an argument for the size
1212
* in bytes, and an argument for an existing pointer that is to be reallocated.
1313
*/
14-
private class ReallocAllocationFunction extends AllocationFunction, TaintFunction {
14+
private class ReallocAllocationFunction extends AllocationFunction, DataFlowFunction {
1515
int sizeArg;
1616
int reallocArg;
1717

@@ -44,7 +44,7 @@ private class ReallocAllocationFunction extends AllocationFunction, TaintFunctio
4444

4545
override int getReallocPtrArg() { result = reallocArg }
4646

47-
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
47+
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
4848
input.isParameterDeref(this.getReallocPtrArg()) and output.isReturnValueDeref()
4949
}
5050
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 39 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -6597,38 +6597,45 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
65976597
| taint.cpp:729:27:729:32 | endptr | taint.cpp:729:26:729:32 | & ... | |
65986598
| taint.cpp:731:7:731:12 | ref arg endptr | taint.cpp:732:8:732:13 | endptr | |
65996599
| taint.cpp:732:8:732:13 | endptr | taint.cpp:732:7:732:13 | * ... | TAINT |
6600-
| taint.cpp:738:17:738:31 | call to indirect_source | taint.cpp:739:30:739:35 | source | |
6601-
| taint.cpp:739:22:739:28 | call to realloc | taint.cpp:740:7:740:10 | dest | |
6602-
| taint.cpp:739:30:739:35 | source | taint.cpp:739:22:739:28 | call to realloc | TAINT |
6603-
| taint.cpp:743:40:743:45 | buffer | taint.cpp:744:5:744:10 | buffer | |
6604-
| taint.cpp:743:40:743:45 | buffer | taint.cpp:745:27:745:32 | buffer | |
6605-
| taint.cpp:744:4:744:10 | * ... | taint.cpp:744:3:744:10 | * ... | TAINT |
6606-
| taint.cpp:744:5:744:10 | buffer | taint.cpp:744:4:744:10 | * ... | TAINT |
6607-
| taint.cpp:744:14:744:19 | call to source | taint.cpp:744:3:744:21 | ... = ... | |
6608-
| taint.cpp:745:19:745:25 | call to realloc | taint.cpp:743:40:743:45 | buffer | |
6609-
| taint.cpp:745:19:745:25 | call to realloc | taint.cpp:745:3:745:37 | ... = ... | |
6610-
| taint.cpp:745:19:745:25 | call to realloc | taint.cpp:746:10:746:15 | buffer | |
6611-
| taint.cpp:745:27:745:32 | buffer | taint.cpp:745:19:745:25 | call to realloc | TAINT |
6612-
| taint.cpp:746:9:746:15 | * ... | taint.cpp:746:8:746:15 | * ... | TAINT |
6613-
| taint.cpp:746:10:746:15 | buffer | taint.cpp:746:9:746:15 | * ... | TAINT |
6614-
| taint.cpp:751:31:751:34 | path | taint.cpp:751:31:751:34 | path | |
6615-
| taint.cpp:751:31:751:34 | path | taint.cpp:752:10:752:13 | path | |
6616-
| taint.cpp:751:31:751:34 | path | taint.cpp:753:10:753:13 | path | |
6617-
| taint.cpp:751:43:751:46 | data | taint.cpp:751:43:751:46 | data | |
6618-
| taint.cpp:751:43:751:46 | data | taint.cpp:753:22:753:25 | data | |
6619-
| taint.cpp:752:10:752:13 | ref arg path | taint.cpp:751:31:751:34 | path | |
6620-
| taint.cpp:752:10:752:13 | ref arg path | taint.cpp:753:10:753:13 | path | |
6621-
| taint.cpp:752:16:752:19 | %s | taint.cpp:752:10:752:13 | ref arg path | TAINT |
6622-
| taint.cpp:752:22:752:26 | abc | taint.cpp:752:10:752:13 | ref arg path | TAINT |
6623-
| taint.cpp:753:10:753:13 | ref arg path | taint.cpp:751:31:751:34 | path | |
6624-
| taint.cpp:753:16:753:19 | %s | taint.cpp:753:10:753:13 | ref arg path | TAINT |
6625-
| taint.cpp:753:22:753:25 | data | taint.cpp:753:10:753:13 | ref arg path | TAINT |
6626-
| taint.cpp:753:22:753:25 | ref arg data | taint.cpp:751:43:751:46 | data | |
6627-
| taint.cpp:757:7:757:10 | path | taint.cpp:758:21:758:24 | path | |
6628-
| taint.cpp:757:7:757:10 | path | taint.cpp:759:8:759:11 | path | |
6629-
| taint.cpp:758:21:758:24 | ref arg path | taint.cpp:759:8:759:11 | path | |
6630-
| taint.cpp:759:8:759:11 | path | taint.cpp:759:7:759:11 | * ... | |
6631-
| taint.cpp:769:37:769:42 | call to source | taint.cpp:770:7:770:9 | obj | |
6600+
| taint.cpp:739:17:739:31 | call to indirect_source | taint.cpp:740:30:740:35 | source | |
6601+
| taint.cpp:740:22:740:28 | call to realloc | taint.cpp:741:7:741:10 | dest | |
6602+
| taint.cpp:740:30:740:35 | source | taint.cpp:740:22:740:28 | call to realloc | TAINT |
6603+
| taint.cpp:744:40:744:45 | buffer | taint.cpp:745:5:745:10 | buffer | |
6604+
| taint.cpp:744:40:744:45 | buffer | taint.cpp:746:27:746:32 | buffer | |
6605+
| taint.cpp:745:4:745:10 | * ... | taint.cpp:745:3:745:10 | * ... | TAINT |
6606+
| taint.cpp:745:5:745:10 | buffer | taint.cpp:745:4:745:10 | * ... | TAINT |
6607+
| taint.cpp:745:14:745:19 | call to source | taint.cpp:745:3:745:21 | ... = ... | |
6608+
| taint.cpp:746:19:746:25 | call to realloc | taint.cpp:744:40:744:45 | buffer | |
6609+
| taint.cpp:746:19:746:25 | call to realloc | taint.cpp:746:3:746:37 | ... = ... | |
6610+
| taint.cpp:746:19:746:25 | call to realloc | taint.cpp:747:10:747:15 | buffer | |
6611+
| taint.cpp:746:27:746:32 | buffer | taint.cpp:746:19:746:25 | call to realloc | TAINT |
6612+
| taint.cpp:747:9:747:15 | * ... | taint.cpp:747:8:747:15 | * ... | TAINT |
6613+
| taint.cpp:747:10:747:15 | buffer | taint.cpp:747:9:747:15 | * ... | TAINT |
6614+
| taint.cpp:752:13:752:18 | call to malloc | taint.cpp:753:2:753:2 | a | |
6615+
| taint.cpp:752:13:752:18 | call to malloc | taint.cpp:754:22:754:22 | a | |
6616+
| taint.cpp:753:2:753:2 | a [post update] | taint.cpp:754:22:754:22 | a | |
6617+
| taint.cpp:753:2:753:16 | ... = ... | taint.cpp:753:5:753:5 | x [post update] | |
6618+
| taint.cpp:753:9:753:14 | call to source | taint.cpp:753:2:753:16 | ... = ... | |
6619+
| taint.cpp:754:14:754:20 | call to realloc | taint.cpp:755:7:755:8 | a2 | |
6620+
| taint.cpp:754:22:754:22 | a | taint.cpp:754:14:754:20 | call to realloc | TAINT |
6621+
| taint.cpp:760:31:760:34 | path | taint.cpp:760:31:760:34 | path | |
6622+
| taint.cpp:760:31:760:34 | path | taint.cpp:761:10:761:13 | path | |
6623+
| taint.cpp:760:31:760:34 | path | taint.cpp:762:10:762:13 | path | |
6624+
| taint.cpp:760:43:760:46 | data | taint.cpp:760:43:760:46 | data | |
6625+
| taint.cpp:760:43:760:46 | data | taint.cpp:762:22:762:25 | data | |
6626+
| taint.cpp:761:10:761:13 | ref arg path | taint.cpp:760:31:760:34 | path | |
6627+
| taint.cpp:761:10:761:13 | ref arg path | taint.cpp:762:10:762:13 | path | |
6628+
| taint.cpp:761:16:761:19 | %s | taint.cpp:761:10:761:13 | ref arg path | TAINT |
6629+
| taint.cpp:761:22:761:26 | abc | taint.cpp:761:10:761:13 | ref arg path | TAINT |
6630+
| taint.cpp:762:10:762:13 | ref arg path | taint.cpp:760:31:760:34 | path | |
6631+
| taint.cpp:762:16:762:19 | %s | taint.cpp:762:10:762:13 | ref arg path | TAINT |
6632+
| taint.cpp:762:22:762:25 | data | taint.cpp:762:10:762:13 | ref arg path | TAINT |
6633+
| taint.cpp:762:22:762:25 | ref arg data | taint.cpp:760:43:760:46 | data | |
6634+
| taint.cpp:766:7:766:10 | path | taint.cpp:767:21:767:24 | path | |
6635+
| taint.cpp:766:7:766:10 | path | taint.cpp:768:8:768:11 | path | |
6636+
| taint.cpp:767:21:767:24 | ref arg path | taint.cpp:768:8:768:11 | path | |
6637+
| taint.cpp:768:8:768:11 | path | taint.cpp:768:7:768:11 | * ... | |
6638+
| taint.cpp:778:37:778:42 | call to source | taint.cpp:779:7:779:9 | obj | |
66326639
| vector.cpp:16:43:16:49 | source1 | vector.cpp:17:26:17:32 | source1 | |
66336640
| vector.cpp:16:43:16:49 | source1 | vector.cpp:31:38:31:44 | source1 | |
66346641
| vector.cpp:17:21:17:33 | call to vector | vector.cpp:19:14:19:14 | v | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -732,6 +732,7 @@ void test_strtol(char *source) {
732732
sink(*endptr); // $ ast,ir
733733
}
734734

735+
void *malloc(size_t);
735736
void *realloc(void *, size_t);
736737

737738
void test_realloc() {
@@ -746,6 +747,14 @@ void test_realloc_2_indirections(int **buffer) {
746747
sink(**buffer); // $ ir MISSING: ast
747748
}
748749

750+
void test_realloc_struct_field() {
751+
struct A { int x; };
752+
A* a = (A*)malloc(sizeof(A));
753+
a->x = source();
754+
A* a2 = (A*)realloc(a, sizeof(A));
755+
sink(a2->x); // $ ir MISSING: ast
756+
}
757+
749758
int sprintf(char *, const char *, ...);
750759

751760
void call_sprintf_twice(char* path, char* data) {

0 commit comments

Comments
 (0)