hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: fix up some iterator taint flows

Browse Source
This commit is contained in:
Robert Marsh
2020-08-27 10:27:53 -07:00
parent c0edc08315
commit 2a6c624407
1 changed files with 3 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
cpp/ql/src/semmle/code/cpp/models/implementations/Iterator.qll
View File

@@ -196,7 +196,7 @@ class IteratorFieldMemberOperator extends Operator, TaintFunction {
}
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isQualifierAddress() and
input.isQualifierObject() and
output.isReturnValue()
}
}
@@ -211,10 +211,7 @@ class IteratorBinaryArithmeticMemberOperator extends MemberFunction, TaintFuncti
}
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
(
input.isQualifierObject() or
input.isParameter(0)
) and
input.isQualifierObject() and
output.isReturnValue()
}
}
@@ -234,9 +231,6 @@ class IteratorAssignArithmeticMemberOperator extends MemberFunction, DataFlowFun
}
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isParameter(0) and
output.isQualifierObject()
or
input.isQualifierObject() and
output.isReturnValueDeref()
}
@@ -252,10 +246,7 @@ class IteratorArrayMemberOperator extends MemberFunction, TaintFunction {
}
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
(
input.isQualifierObject() or
input.isParameter(0)
) and
input.isQualifierObject() and
output.isReturnValue()
}
}