Skip to content

Commit 74b774e

Browse files
MathiasVPMathiasVP
authored
Merge pull request #20769 from MathiasVP/add-more-flow-models
C++: Add a few more models
2 parents dbadb6f + 56b9566 commit 74b774e

9 files changed

Lines changed: 278 additions & 8 deletions

File tree

‎cpp/ql/lib/ext/cctype.model.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: summaryModel
5+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
6+
- ["", "", False, "tolower", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
7+
- ["std", "", False, "tolower", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
8+
- ["", "", False, "toupper", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
9+
- ["std", "", False, "toupper", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

‎cpp/ql/lib/ext/iconv.model.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: summaryModel
5+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
6+
- ["", "", False, "iconv", "", "", "Argument[**1]", "Argument[**3]", "value", "manual"]
7+

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ import semmle.code.cpp.models.interfaces.Taint
1212
import semmle.code.cpp.models.interfaces.NonThrowing
1313

1414
/**
15-
* The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant
16-
* `__builtin___memcpy_chk`.
15+
* The standard functions `memcpy`, `memmove` and `bcopy`; and variants such as
16+
* `__builtin___memcpy_chk` and `__builtin___memmove_chk`.
1717
*/
1818
private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction,
1919
AliasFunction, NonCppThrowingFunction
@@ -27,7 +27,9 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
2727
// bcopy(src, dest, num)
2828
// mempcpy(dest, src, num)
2929
// memccpy(dest, src, c, n)
30-
this.hasGlobalName(["bcopy", mempcpy(), "memccpy", "__builtin___memcpy_chk"])
30+
this.hasGlobalName([
31+
"bcopy", mempcpy(), "memccpy", "__builtin___memcpy_chk", "__builtin___memmove_chk"
32+
])
3133
}
3234

3335
/**

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
1919
this.hasGlobalOrStdName("wmemset")
2020
or
2121
this.hasGlobalName([
22-
bzero(), "__builtin_memset", "__builtin_memset_chk", "RtlZeroMemory", "RtlSecureZeroMemory"
22+
bzero(), "__builtin_memset", "__builtin_memset_chk", "__builtin___memset_chk",
23+
"RtlZeroMemory", "RtlSecureZeroMemory"
2324
])
2425
}
2526

@@ -32,7 +33,7 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
3233
or
3334
this.hasGlobalOrStdName("wmemset")
3435
or
35-
this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk"])
36+
this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk", "__builtin___memset_chk"])
3637
) and
3738
result = 1
3839
}

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,9 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
3030
"_mbsncat", // _mbsncat(dst, src, max_amount)
3131
"_mbsncat_l", // _mbsncat_l(dst, src, max_amount, locale)
3232
"_mbsnbcat", // _mbsnbcat(dest, src, count)
33-
"_mbsnbcat_l" // _mbsnbcat_l(dest, src, count, locale)
33+
"_mbsnbcat_l", // _mbsnbcat_l(dest, src, count, locale)
34+
"__builtin___strcat_chk", // __builtin___strcat_chk (dest, src, magic)
35+
"__builtin___strncat_chk" // __builtin___strncat_chk (dest, src, max_amount, magic)
3436
])
3537
}
3638

@@ -56,7 +58,7 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
5658

5759
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
5860
(
59-
this.getName() = ["strncat", "wcsncat", "_mbsncat", "_mbsncat_l"] and
61+
this.getName() = ["strncat", "wcsncat", "_mbsncat", "_mbsncat_l", "__builtin___strncat_chk"] and
6062
input.isParameter(2)
6163
or
6264
this.getName() = ["_mbsncat_l", "_mbsnbcat_l"] and

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,11 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
3636
"_mbsnbcpy", // _mbsnbcpy(dest, src, max_amount)
3737
"stpcpy", // stpcpy(dest, src)
3838
"stpncpy", // stpncpy(dest, src, max_amount)
39-
"strlcpy" // strlcpy(dst, src, dst_size)
39+
"strlcpy", // strlcpy(dst, src, dst_size)
40+
"__builtin___strcpy_chk", // __builtin___strcpy_chk (dest, src, magic)
41+
"__builtin___stpcpy_chk", // __builtin___stpcpy_chk (dest, src, magic)
42+
"__builtin___stpncpy_chk", // __builtin___stpncpy_chk(dest, src, max_amount, magic)
43+
"__builtin___strncpy_chk" // __builtin___strncpy_chk (dest, src, max_amount, magic)
4044
])
4145
or
4246
(

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7988,6 +7988,26 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
79887988
| taint.cpp:841:21:841:35 | call to indirect_source | taint.cpp:843:16:843:17 | fp | |
79897989
| taint.cpp:842:11:842:12 | ref arg fp | taint.cpp:843:16:843:17 | fp | |
79907990
| taint.cpp:842:15:842:16 | | taint.cpp:842:11:842:12 | ref arg fp | TAINT |
7991+
| taint.cpp:851:10:851:15 | call to source | taint.cpp:852:18:852:18 | s | |
7992+
| taint.cpp:851:10:851:15 | call to source | taint.cpp:854:18:854:18 | s | |
7993+
| taint.cpp:852:10:852:16 | call to toupper | taint.cpp:853:7:853:7 | u | |
7994+
| taint.cpp:854:10:854:16 | call to tolower | taint.cpp:855:7:855:7 | l | |
7995+
| taint.cpp:861:24:861:27 | size | taint.cpp:866:16:866:19 | size | |
7996+
| taint.cpp:862:12:862:26 | call to indirect_source | taint.cpp:866:12:866:12 | s | |
7997+
| taint.cpp:863:7:863:9 | out | taint.cpp:864:12:864:14 | out | |
7998+
| taint.cpp:864:12:864:14 | out | taint.cpp:866:23:866:23 | p | |
7999+
| taint.cpp:864:12:864:14 | out | taint.cpp:867:8:867:8 | p | |
8000+
| taint.cpp:865:9:865:16 | size_out | taint.cpp:866:27:866:34 | size_out | |
8001+
| taint.cpp:866:11:866:12 | ref arg & ... | taint.cpp:866:12:866:12 | s [inner post update] | |
8002+
| taint.cpp:866:12:866:12 | s | taint.cpp:866:11:866:12 | & ... | |
8003+
| taint.cpp:866:15:866:19 | ref arg & ... | taint.cpp:866:16:866:19 | size [inner post update] | |
8004+
| taint.cpp:866:16:866:19 | size | taint.cpp:866:15:866:19 | & ... | |
8005+
| taint.cpp:866:22:866:23 | ref arg & ... | taint.cpp:866:23:866:23 | p [inner post update] | |
8006+
| taint.cpp:866:22:866:23 | ref arg & ... | taint.cpp:867:8:867:8 | p | |
8007+
| taint.cpp:866:23:866:23 | p | taint.cpp:866:22:866:23 | & ... | |
8008+
| taint.cpp:866:26:866:34 | ref arg & ... | taint.cpp:866:27:866:34 | size_out [inner post update] | |
8009+
| taint.cpp:866:27:866:34 | size_out | taint.cpp:866:26:866:34 | & ... | |
8010+
| taint.cpp:867:8:867:8 | p | taint.cpp:867:7:867:8 | * ... | TAINT |
79918011
| thread.cpp:10:27:10:27 | s | thread.cpp:10:27:10:27 | s | |
79928012
| thread.cpp:10:27:10:27 | s | thread.cpp:11:8:11:8 | s | |
79938013
| thread.cpp:14:26:14:26 | s | thread.cpp:15:8:15:8 | s | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -842,4 +842,27 @@ int f7(void)
842842
fprintf(fp, "");
843843
indirect_sink(fp); // $ ir MISSING: ast
844844
return 0;
845+
}
846+
847+
int toupper(int);
848+
int tolower(int);
849+
850+
void test_toupper_and_tolower() {
851+
int s = source();
852+
int u = toupper(s);
853+
sink(u); // $ ir MISSING: ast
854+
int l = tolower(s);
855+
sink(l); // $ ir MISSING: ast
856+
}
857+
858+
typedef int iconv_t;
859+
size_t iconv(iconv_t cd, char **, size_t *, char **, size_t *);
860+
861+
void test_iconv(size_t size) {
862+
char* s = indirect_source();
863+
char out[10];
864+
char* p = out;
865+
size_t size_out;
866+
iconv(0, &s, &size, &p, &size_out);
867+
sink(*p); // $ ast,ir
845868
}

0 commit comments

Comments
 (0)