hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Block flow out of 'swap'.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2024-02-06 16:05:48 +00:00
parent e539aca337
commit 359b6e14c6
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cpp/ql/lib/semmle/code/cpp/models/implementations/Swap.qll
View File

@@ -1,6 +1,7 @@
import semmle.code.cpp.models.interfaces.DataFlow
import semmle.code.cpp.models.interfaces.Taint
import semmle.code.cpp.models.interfaces.Alias
import semmle.code.cpp.models.interfaces.FlowOutBarrier
/**
* The standard function `swap`. A use of `swap` looks like this:
@@ -8,7 +9,7 @@ import semmle.code.cpp.models.interfaces.Alias
* std::swap(obj1, obj2)
* ```
*/
private class Swap extends DataFlowFunction {
private class Swap extends DataFlowFunction, FlowOutBarrierFunction {
Swap() { this.hasQualifiedName(["std", "bsl"], "swap") }
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
@@ -18,6 +19,8 @@ private class Swap extends DataFlowFunction {
input.isParameterDeref(1) and
output.isParameterDeref(0)
}
override predicate isFlowOutBarrier(FunctionInput input) { input.isParameterDeref(1) }
}
/**
@@ -26,7 +29,9 @@ private class Swap extends DataFlowFunction {
* obj1.swap(obj2)
* ```
*/
private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction {
private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction,
FlowOutBarrierFunction
{
MemberSwap() {
this.hasName("swap") and
this.getNumberOfParameters() = 1 and
@@ -47,4 +52,8 @@ private class MemberSwap extends TaintFunction, MemberFunction, AliasFunction {
override predicate parameterEscapesOnlyViaReturn(int index) { index = 0 }
override predicate parameterIsAlwaysReturned(int index) { index = 0 }
override predicate isFlowOutBarrier(FunctionInput input) {
input.isQualifierObject() or input.isParameterDeref(0)
}
}