hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Block flow out of 'swap'.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2024-02-06 16:05:48 +00:00
parent e539aca337
commit 359b6e14c6
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cpp/ql/lib/semmle/code/cpp/models/implementations/Swap.qll
View File

@@ -1,6 +1,7 @@
import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.DataFlow
import semmle.code.cpp.models.interfaces.Taint import semmle.code.cpp.models.interfaces.Taint
import semmle.code.cpp.models.interfaces.Alias import semmle.code.cpp.models.interfaces.Alias
import semmle.code.cpp.models.interfaces.FlowOutBarrier
/** /**
* The standard function `swap`. A use of `swap` looks like this: * The standard function `swap`. A use of `swap` looks like this:
@@ -8,7 +9,7 @@ import semmle.code.cpp.models.interfaces.Alias
* std::swap(obj1, obj2) * std::swap(obj1, obj2)
* ``` * ```
*/ */
private class Swap extends DataFlowFunction { private class Swap extends DataFlowFunction, FlowOutBarrierFunction {
Swap() { this.hasQualifiedName(["std", "bsl"], "swap") } Swap() { this.hasQualifiedName(["std", "bsl"], "swap") }
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) { override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -18,6 +19,8 @@ private class Swap extends DataFlowFunction {
input.isParameterDeref(1) and input.isParameterDeref(1) and
output.isParameterDeref(0) output.isParameterDeref(0)
} }
override predicate isFlowOutBarrier(FunctionInput input) { input.isParameterDeref(1) }
} }
/** /**
@@ -26,7 +29,9 @@ private class Swap extends DataFlowFunction {
* obj1.swap(obj2) * obj1.swap(obj2)
* ``` * ```
*/ */
private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction { private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction,
FlowOutBarrierFunction
{
MemberSwap() { MemberSwap() {
this.hasName("swap") and this.hasName("swap") and
this.getNumberOfParameters() = 1 and this.getNumberOfParameters() = 1 and
@@ -47,4 +52,8 @@ private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction {
override predicate parameterEscapesOnlyViaReturn(int index) { index = 0 } override predicate parameterEscapesOnlyViaReturn(int index) { index = 0 }
override predicate parameterIsAlwaysReturned(int index) { index = 0 } override predicate parameterIsAlwaysReturned(int index) { index = 0 }
override predicate isFlowOutBarrier(FunctionInput input) {
input.isQualifierObject() or input.isParameterDeref(0)
}
} }