Skip to content

Commit b41d47b

Browse files
committed
Swift: Array.withUnsafeBytes doesn't reliably match ContiguousBytes, so define models there as well.
1 parent c48d474 commit b41d47b

File tree

2 files changed

+5
-2
lines changed
  • swift/ql
    • lib/codeql/swift/frameworks/StandardLibrary
    • test/library-tests/dataflow/taint/libraries

2 files changed

+5
-2
lines changed

swift/ql/lib/codeql/swift/frameworks/StandardLibrary/Array.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ private class ArraySummaries extends SummaryModelCsv {
2626
";Array;true;withUnsafeMutableBufferPointer(_:);;;Argument[-1];Argument[0].Parameter[0];taint",
2727
";Array;true;withUnsafeMutableBufferPointer(_:);;;Argument[0].Parameter[0];Argument[-1];taint",
2828
";Array;true;withUnsafeMutableBufferPointer(_:);;;Argument[0].ReturnValue;ReturnValue;value",
29+
";Array;true;withUnsafeBytes(_:);;;Argument[-1];Argument[0].Parameter[0];taint",
30+
";Array;true;withUnsafeBytes(_:);;;Argument[-1].ArrayElement;Argument[0].Parameter[0];taint",
31+
";Array;true;withUnsafeBytes(_:);;;Argument[0].ReturnValue;ReturnValue;value",
2932
";Array;true;withUnsafeMutableBytes(_:);;;Argument[-1];Argument[0].Parameter[0];taint",
3033
";Array;true;withUnsafeMutableBytes(_:);;;Argument[0].Parameter[0];Argument[-1];taint",
3134
";Array;true;withUnsafeMutableBytes(_:);;;Argument[0].ReturnValue;ReturnValue;value",

swift/ql/test/library-tests/dataflow/taint/libraries/int.swift

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ func taintThroughClosurePointer() {
1919
sink(arg: ptr1[0]) // $ MISSING: tainted=13
2020
return source()
2121
})
22-
sink(arg: return1) // $ MISSING: tainted=20
22+
sink(arg: return1) // $ tainted=20
2323

2424
// ---
2525

@@ -110,7 +110,7 @@ func taintThroughMutablePointer() {
110110
sink(arg: ptr4[0]) // $ MISSING: tainted=97
111111
return source()
112112
})
113-
sink(arg: return5) // $ MISSING: tainted=111
113+
sink(arg: return5) // $ tainted=111
114114
return source()
115115
})
116116
sink(arg: return4) // $ tainted=114

0 commit comments

Comments
 (0)