hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Block try_emplace arg 0.

Browse Source
This commit is contained in:
Geoffrey White
2020-10-09 10:04:22 +01:00
parent 8786fe1ab8
commit 1f1be3bf9a
2 changed files with 3 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
cpp/ql/src/semmle/code/cpp/models/implementations/StdMap.qll
View File

@@ -81,11 +81,10 @@ class StdMapTryEmplace extends TaintFunction {
// flow from any parameter apart from the key to qualifier and return value
// (here we assume taint flow from any constructor parameter to the constructed object)
// (where the return value is a pair, this should really flow just to the first part of it)
exists(int arg | arg = [0 .. getNumberOfParameters() - 1] |
exists(int arg | arg = [1 .. getNumberOfParameters() - 1] |
(
getUnspecifiedType() instanceof Iterator and arg != 1
or
not getUnspecifiedType() instanceof Iterator and arg != 0
not getUnspecifiedType() instanceof Iterator or
arg != 1
) and
input.isParameterDeref(arg)
) and

12
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -1199,8 +1199,6 @@
| map.cpp:248:23:248:25 | ref arg m27 | map.cpp:250:23:250:25 | m27 | |
| map.cpp:248:23:248:25 | ref arg m27 | map.cpp:251:7:251:9 | m27 | |
| map.cpp:248:23:248:25 | ref arg m27 | map.cpp:252:1:252:1 | m27 | |
| map.cpp:248:23:248:33 | call to iterator | map.cpp:248:7:248:9 | ref arg m27 | TAINT |
| map.cpp:248:23:248:33 | call to iterator | map.cpp:248:11:248:21 | call to try_emplace | TAINT |
| map.cpp:248:27:248:31 | call to begin | map.cpp:248:23:248:33 | call to iterator | TAINT |
| map.cpp:248:43:248:47 | def | map.cpp:248:7:248:9 | ref arg m27 | TAINT |
| map.cpp:248:43:248:47 | def | map.cpp:248:11:248:21 | call to try_emplace | TAINT |
@@ -1211,8 +1209,6 @@
| map.cpp:250:23:250:25 | ref arg m27 | map.cpp:250:7:250:9 | m27 | |
| map.cpp:250:23:250:25 | ref arg m27 | map.cpp:251:7:251:9 | m27 | |
| map.cpp:250:23:250:25 | ref arg m27 | map.cpp:252:1:252:1 | m27 | |
| map.cpp:250:23:250:33 | call to iterator | map.cpp:250:7:250:9 | ref arg m27 | TAINT |
| map.cpp:250:23:250:33 | call to iterator | map.cpp:250:11:250:21 | call to try_emplace | TAINT |
| map.cpp:250:27:250:31 | call to begin | map.cpp:250:23:250:33 | call to iterator | TAINT |
| map.cpp:250:43:250:48 | call to source | map.cpp:250:7:250:9 | ref arg m27 | TAINT |
| map.cpp:250:43:250:48 | call to source | map.cpp:250:11:250:21 | call to try_emplace | TAINT |
@@ -1872,8 +1868,6 @@
| map.cpp:399:23:399:25 | ref arg m27 | map.cpp:401:23:401:25 | m27 | |
| map.cpp:399:23:399:25 | ref arg m27 | map.cpp:402:7:402:9 | m27 | |
| map.cpp:399:23:399:25 | ref arg m27 | map.cpp:422:1:422:1 | m27 | |
| map.cpp:399:23:399:33 | call to iterator | map.cpp:399:7:399:9 | ref arg m27 | TAINT |
| map.cpp:399:23:399:33 | call to iterator | map.cpp:399:11:399:21 | call to try_emplace | TAINT |
| map.cpp:399:27:399:31 | call to begin | map.cpp:399:23:399:33 | call to iterator | TAINT |
| map.cpp:399:43:399:47 | def | map.cpp:399:7:399:9 | ref arg m27 | TAINT |
| map.cpp:399:43:399:47 | def | map.cpp:399:11:399:21 | call to try_emplace | TAINT |
@@ -1884,8 +1878,6 @@
| map.cpp:401:23:401:25 | ref arg m27 | map.cpp:401:7:401:9 | m27 | |
| map.cpp:401:23:401:25 | ref arg m27 | map.cpp:402:7:402:9 | m27 | |
| map.cpp:401:23:401:25 | ref arg m27 | map.cpp:422:1:422:1 | m27 | |
| map.cpp:401:23:401:33 | call to iterator | map.cpp:401:7:401:9 | ref arg m27 | TAINT |
| map.cpp:401:23:401:33 | call to iterator | map.cpp:401:11:401:21 | call to try_emplace | TAINT |
| map.cpp:401:27:401:31 | call to begin | map.cpp:401:23:401:33 | call to iterator | TAINT |
| map.cpp:401:43:401:48 | call to source | map.cpp:401:7:401:9 | ref arg m27 | TAINT |
| map.cpp:401:43:401:48 | call to source | map.cpp:401:11:401:21 | call to try_emplace | TAINT |
@@ -1902,8 +1894,6 @@
| map.cpp:403:23:403:25 | ref arg m28 | map.cpp:405:23:405:25 | m28 | |
| map.cpp:403:23:403:25 | ref arg m28 | map.cpp:406:7:406:9 | m28 | |
| map.cpp:403:23:403:25 | ref arg m28 | map.cpp:422:1:422:1 | m28 | |
| map.cpp:403:23:403:33 | call to iterator | map.cpp:403:7:403:9 | ref arg m28 | TAINT |
| map.cpp:403:23:403:33 | call to iterator | map.cpp:403:11:403:21 | call to try_emplace | TAINT |
| map.cpp:403:27:403:31 | call to begin | map.cpp:403:23:403:33 | call to iterator | TAINT |
| map.cpp:403:43:403:47 | def | map.cpp:403:7:403:9 | ref arg m28 | TAINT |
| map.cpp:403:43:403:47 | def | map.cpp:403:11:403:21 | call to try_emplace | TAINT |
@@ -1914,8 +1904,6 @@
| map.cpp:405:23:405:25 | ref arg m28 | map.cpp:405:7:405:9 | m28 | |
| map.cpp:405:23:405:25 | ref arg m28 | map.cpp:406:7:406:9 | m28 | |
| map.cpp:405:23:405:25 | ref arg m28 | map.cpp:422:1:422:1 | m28 | |
| map.cpp:405:23:405:33 | call to iterator | map.cpp:405:7:405:9 | ref arg m28 | TAINT |
| map.cpp:405:23:405:33 | call to iterator | map.cpp:405:11:405:21 | call to try_emplace | TAINT |
| map.cpp:405:27:405:31 | call to begin | map.cpp:405:23:405:33 | call to iterator | TAINT |
| map.cpp:405:46:405:50 | def | map.cpp:405:7:405:9 | ref arg m28 | TAINT |
| map.cpp:405:46:405:50 | def | map.cpp:405:11:405:21 | call to try_emplace | TAINT |