diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected index 907cccd197b..85fc3526dc7 100644 --- a/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected +++ b/cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected @@ -8090,20 +8090,20 @@ | vector.cpp:520:25:520:31 | call to vector | vector.cpp:523:8:523:9 | vs | | | vector.cpp:520:25:520:31 | call to vector | vector.cpp:524:8:524:9 | vs | | | vector.cpp:520:25:520:31 | call to vector | vector.cpp:526:8:526:9 | vs | | -| vector.cpp:520:25:520:31 | call to vector | vector.cpp:532:8:532:9 | vs | | -| vector.cpp:520:25:520:31 | call to vector | vector.cpp:533:2:533:2 | vs | | +| vector.cpp:520:25:520:31 | call to vector | vector.cpp:539:8:539:9 | vs | | +| vector.cpp:520:25:520:31 | call to vector | vector.cpp:540:2:540:2 | vs | | | vector.cpp:520:30:520:30 | 0 | vector.cpp:520:25:520:31 | call to vector | TAINT | | vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:524:8:524:9 | vs | | | vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:526:8:526:9 | vs | | -| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | | -| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | | +| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:539:8:539:9 | vs | | +| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:540:2:540:2 | vs | | | vector.cpp:523:8:523:9 | vs | vector.cpp:523:10:523:10 | call to operator[] | TAINT | | vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:526:8:526:9 | vs | | -| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | | -| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | | +| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:539:8:539:9 | vs | | +| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:540:2:540:2 | vs | | | vector.cpp:524:8:524:9 | vs | vector.cpp:524:10:524:10 | call to operator[] | TAINT | -| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | | -| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | | +| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:539:8:539:9 | vs | | +| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:540:2:540:2 | vs | | | vector.cpp:526:8:526:9 | vs | vector.cpp:526:11:526:15 | call to begin | TAINT | | vector.cpp:526:11:526:15 | call to begin | vector.cpp:526:3:526:17 | ... = ... | | | vector.cpp:526:11:526:15 | call to begin | vector.cpp:527:9:527:10 | it | | @@ -8128,5 +8128,5 @@ | vector.cpp:530:3:530:4 | ref arg it | vector.cpp:531:9:531:10 | it | | | vector.cpp:530:9:530:14 | call to source | vector.cpp:530:3:530:4 | ref arg it | TAINT | | vector.cpp:531:9:531:10 | it | vector.cpp:531:8:531:8 | call to operator* | TAINT | -| vector.cpp:532:8:532:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | | -| vector.cpp:532:8:532:9 | vs | vector.cpp:532:10:532:10 | call to operator[] | TAINT | +| vector.cpp:539:8:539:9 | ref arg vs | vector.cpp:540:2:540:2 | vs | | +| vector.cpp:539:8:539:9 | vs | vector.cpp:539:10:539:10 | call to operator[] | TAINT | diff --git a/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp b/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp index 4bc1073634a..ca8240c8999 100644 --- a/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp +++ b/cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp @@ -523,12 +523,19 @@ void test_vector_iterator() { sink(vs[1]); sink(vs[source()]); // $ MISSING: ast,ir - it = vs.begin(); + it = vs.begin(); // (1) sink(*it); it += 1; sink(*it); - it += source(); - sink(*it); // $ ast,ir - sink(vs[1]); // $ SPURIOUS: ir + it += source(); // (2) + sink(*it); // $ ast,ir // (3) + // This FP happens because of the following flows: + // 1. There's a write to the iterator at (2) + // 2. This write propagates to `it` on the next line at (3) + // 3. There's a taint step from `it` to `*it` at (3) + // 4. The `*it` is seen as a use of `vs` because of (1). + // 5. There's use-use flow from `*it` at (3) (which is a use of `vs`) to `vs` at (4) + // 6. There's a taint step from vs to vs[1] + sink(vs[1]); // $ SPURIOUS: ir // (4) } }