hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into interleave-op-instr-field-flow

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2020-11-09 09:58:19 +01:00
parent 177f94368e 9f2eb84f2b
commit 3c2fb5a93f
603 changed files with 57393 additions and 24593 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/defaulttainttracking.cpp
View File

@@ -9,7 +9,7 @@
int main(int argc, char *argv[]) {
int main() {
@@ -208,4 +208,50 @@ void test_field_to_obj_test_pointer_arith(Point* pp) {
(pp + sizeof(*pp))->x = getenv("VAR")[0];
sink(pp); // tainted [field -> object]
sink(pp + sizeof(*pp)); // tainted [field -> object]
}
}
void sink(char **);
void test_pointers1()
{
char buffer[1024];
char *s = getenv("VAR");
char *ptr1, **ptr2;
char *ptr3, **ptr4;
ptr1 = buffer;
ptr2 = &ptr1;
memcpy(buffer, s, 1024);
ptr3 = buffer;
ptr4 = &ptr3;
sink(buffer); // tainted
sink(ptr1); // tainted
sink(ptr2);
sink(*ptr2); // tainted [NOT DETECTED]
sink(ptr3); // tainted
sink(ptr4);
sink(*ptr4); // tainted [NOT DETECTED]
}
void test_pointers2()
{
char buffer[1024];
char *s = getenv("VAR");
char *ptr1, **ptr2;
char *ptr3, **ptr4;
ptr1 = buffer;
ptr2 = &ptr1;
memcpy(*ptr2, s, 1024);
ptr3 = buffer;
ptr4 = &ptr3;
sink(buffer); // tainted [NOT DETECTED]
sink(ptr1); // tainted [NOT DETECTED]
sink(ptr2);
sink(*ptr2); // tainted [NOT DETECTED]
sink(ptr3); // tainted [NOT DETECTED]
sink(ptr4);
sink(*ptr4); // tainted [NOT DETECTED]
}

3
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/shared.h
View File

@@ -12,3 +12,6 @@ char *strcat(char * s1, const char * s2);
char *strdup(const char *string);
char *_strdup(const char *string);
char *unmodeled_function(const char *const_string);
typedef unsigned long size_t;
void *memcpy(void *s1, const void *s2, size_t n);

16
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/stl.cpp
View File

@@ -71,9 +71,9 @@ void test_string()
sink(a); // tainted
sink(b);
sink(c); // tainted [NOT DETECTED]
sink(c); // tainted
sink(b.c_str());
sink(c.c_str()); // tainted [NOT DETECTED]
sink(c.c_str()); // tainted
}
void test_stringstream()
@@ -91,12 +91,12 @@ void test_stringstream()
sink(ss2); // tainted
sink(ss3); // tainted [NOT DETECTED]
sink(ss4); // tainted
sink(ss5); // tainted [NOT DETECTED]
sink(ss5); // tainted
sink(ss1.str());
sink(ss2.str()); // tainted
sink(ss3.str()); // tainted [NOT DETECTED]
sink(ss4.str()); // tainted
sink(ss5.str()); // tainted [NOT DETECTED]
sink(ss5.str()); // tainted
}
void test_stringstream_int(int source)
@@ -123,14 +123,14 @@ void sink(const char *filename, const char *mode);
void test_strings2()
{
string path1 = user_input();
sink(path1.c_str(), "r"); // tainted [NOT DETECTED]
sink(path1.c_str(), "r"); // tainted
string path2;
path2 = user_input();
sink(path2.c_str(), "r"); // tainted
string path3(user_input());
sink(path3.c_str(), "r"); // tainted [NOT DETECTED]
sink(path3.c_str(), "r"); // tainted
}
void test_string3()
@@ -141,7 +141,7 @@ void test_string3()
std::string ss(cs);
sink(cs); // tainted
sink(ss); // tainted [NOT DETECTED]
sink(ss); // tainted
}
void test_string4()
@@ -155,5 +155,5 @@ void test_string4()
cs = ss.c_str();
sink(cs); // tainted [NOT DETECTED]
sink(ss); // tainted [NOT DETECTED]
sink(ss); // tainted
}

51
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected
View File

@@ -90,6 +90,7 @@
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:32 | (reference dereference) |
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:23 | call to getenv |
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:30 | (reference to) |
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:30 | temporary object |
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | shared.h:5:23:5:31 | sinkparam |
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | defaulttainttracking.cpp:91:42:91:44 | arg |
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | defaulttainttracking.cpp:92:12:92:14 | arg |
@@ -134,6 +135,26 @@
| defaulttainttracking.cpp:208:27:208:32 | call to getenv | defaulttainttracking.cpp:208:27:208:32 | call to getenv |
| defaulttainttracking.cpp:208:27:208:32 | call to getenv | defaulttainttracking.cpp:208:27:208:42 | (int)... |
| defaulttainttracking.cpp:208:27:208:32 | call to getenv | defaulttainttracking.cpp:208:27:208:42 | access to array |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:218:8:218:8 | s |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:218:12:218:17 | call to getenv |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:224:2:224:7 | call to memcpy |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:224:17:224:17 | (const void *)... |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:224:17:224:17 | s |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:228:7:228:12 | (const char *)... |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:228:7:228:12 | array to pointer conversion |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:228:7:228:12 | buffer |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:229:7:229:10 | (const char *)... |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:229:7:229:10 | ptr1 |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:232:7:232:10 | (const char *)... |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:232:7:232:10 | ptr3 |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | shared.h:5:23:5:31 | sinkparam |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | shared.h:17:36:17:37 | s2 |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:240:8:240:8 | s |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:240:12:240:17 | call to getenv |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:246:2:246:7 | call to memcpy |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:246:16:246:16 | (const void *)... |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:246:16:246:16 | s |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | shared.h:17:36:17:37 | s2 |
| dispatch.cpp:28:29:28:34 | call to getenv | dispatch.cpp:28:24:28:27 | call to atoi |
| dispatch.cpp:28:29:28:34 | call to getenv | dispatch.cpp:28:29:28:34 | call to getenv |
| dispatch.cpp:28:29:28:34 | call to getenv | dispatch.cpp:28:29:28:45 | (const char *)... |
@@ -176,7 +197,9 @@
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:21:29:21:29 | s |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:43:78:43:104 | (unnamed parameter 0) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:43:114:43:118 | (unnamed parameter 1) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:44:176:44:178 | str |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:62:25:62:30 | call to getenv |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:63:30:63:30 | s |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:64:36:64:36 | s |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:68:8:68:8 | a |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:68:12:68:17 | call to source |
@@ -185,6 +208,11 @@
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:70:16:70:24 | call to basic_string |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:72:7:72:7 | (const char *)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:72:7:72:7 | a |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:74:7:74:7 | (const string)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:74:7:74:7 | (reference to) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:74:7:74:7 | c |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:76:7:76:7 | (const basic_string<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:76:7:76:7 | c |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:82:16:82:21 | call to source |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:82:16:82:23 | (const char *)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:82:16:82:24 | call to basic_string |
@@ -203,40 +231,63 @@
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:87:9:87:16 | (const char *)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:87:18:87:18 | call to operator<< |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:87:18:87:26 | (reference dereference) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:6:88:6 | call to operator<< |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:6:88:10 | (reference dereference) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:9:88:9 | (const basic_string<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:9:88:9 | (reference to) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:9:88:9 | t |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:91:7:91:9 | (const stringstream)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:91:7:91:9 | (reference to) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:91:7:91:9 | ss2 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:93:7:93:9 | (const stringstream)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:93:7:93:9 | (reference to) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:93:7:93:9 | ss4 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:94:7:94:9 | (const stringstream)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:94:7:94:9 | (reference to) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:94:7:94:9 | ss5 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:96:7:96:9 | (const basic_stringstream<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:96:7:96:9 | ss2 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:98:7:98:9 | (const basic_stringstream<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:98:7:98:9 | ss4 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:99:7:99:9 | (const basic_stringstream<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:99:7:99:9 | ss5 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:118:10:118:15 | call to source |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:125:16:125:28 | call to basic_string |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:125:17:125:26 | call to user_input |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:125:17:125:28 | (const char *)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:126:7:126:11 | (const basic_string<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:126:7:126:11 | path1 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:128:9:128:13 | path2 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:129:10:129:19 | call to user_input |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:129:10:129:21 | (const char *)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:129:10:129:21 | call to basic_string |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:129:10:129:21 | temporary object |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:130:7:130:11 | (const basic_string<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:130:7:130:11 | path2 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:132:15:132:24 | call to user_input |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:132:15:132:26 | (const char *)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:132:15:132:27 | call to basic_string |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:133:7:133:11 | (const basic_string<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:133:7:133:11 | path3 |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:138:14:138:15 | cs |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:138:19:138:24 | call to source |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:138:19:138:26 | (const char *)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:141:17:141:18 | cs |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:141:17:141:19 | call to basic_string |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:143:7:143:8 | cs |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:144:7:144:8 | (const string)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:144:7:144:8 | (reference to) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:144:7:144:8 | ss |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:149:14:149:15 | cs |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:149:19:149:24 | call to source |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:149:19:149:26 | (const char *)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:152:17:152:18 | cs |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:152:17:152:19 | call to basic_string |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:155:7:155:8 | (const basic_string<char, char_traits<char>, allocator<char>>)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:155:7:155:8 | ss |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:158:7:158:8 | (const string)... |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:158:7:158:8 | (reference to) |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:158:7:158:8 | ss |
| test_diff.cpp:92:10:92:13 | argv | shared.h:5:23:5:31 | sinkparam |
| test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:92:10:92:13 | argv |
| test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:92:10:92:16 | (const char *)... |

75
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.expected
View File

@@ -12,6 +12,7 @@
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:32 | (const char *)... | IR only |
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:32 | (reference dereference) | IR only |
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:30 | (reference to) | IR only |
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:30 | temporary object | IR only |
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | shared.h:5:23:5:31 | sinkparam | IR only |
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | defaulttainttracking.cpp:91:31:91:33 | ret | AST only |
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | defaulttainttracking.cpp:92:5:92:8 | * ... | AST only |
@@ -36,12 +37,63 @@
| defaulttainttracking.cpp:195:11:195:16 | call to getenv | defaulttainttracking.cpp:195:7:195:7 | x | AST only |
| defaulttainttracking.cpp:201:13:201:18 | call to getenv | defaulttainttracking.cpp:201:9:201:9 | x | AST only |
| defaulttainttracking.cpp:208:27:208:32 | call to getenv | defaulttainttracking.cpp:208:23:208:23 | x | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:213:11:213:14 | (unnamed parameter 0) | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:217:7:217:12 | buffer | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:219:8:219:11 | ptr1 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:219:16:219:19 | ptr2 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:220:8:220:11 | ptr3 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:220:16:220:19 | ptr4 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:222:2:222:5 | ptr1 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:222:9:222:14 | buffer | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:223:2:223:5 | ptr2 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:223:9:223:13 | & ... | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:223:10:223:13 | ptr1 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:224:9:224:14 | buffer | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:225:2:225:5 | ptr3 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:225:9:225:14 | buffer | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:226:2:226:5 | ptr4 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:226:9:226:13 | & ... | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:226:10:226:13 | ptr3 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:228:7:228:12 | (const char *)... | IR only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:228:7:228:12 | array to pointer conversion | IR only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:230:7:230:10 | ptr2 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:231:7:231:11 | (const char *)... | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:231:7:231:11 | * ... | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:231:8:231:11 | ptr2 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:233:7:233:10 | ptr4 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:234:7:234:11 | (const char *)... | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:234:7:234:11 | * ... | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | defaulttainttracking.cpp:234:8:234:11 | ptr4 | AST only |
| defaulttainttracking.cpp:218:12:218:17 | call to getenv | shared.h:17:20:17:21 | s1 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:213:11:213:14 | (unnamed parameter 0) | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:241:8:241:11 | ptr1 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:241:16:241:19 | ptr2 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:245:2:245:5 | ptr2 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:245:9:245:13 | & ... | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:245:10:245:13 | ptr1 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:246:9:246:13 | * ... | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:246:10:246:13 | ptr2 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:251:7:251:10 | (const char *)... | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:251:7:251:10 | ptr1 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:252:7:252:10 | ptr2 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:253:7:253:11 | (const char *)... | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:253:7:253:11 | * ... | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | defaulttainttracking.cpp:253:8:253:11 | ptr2 | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | shared.h:5:23:5:31 | sinkparam | AST only |
| defaulttainttracking.cpp:240:12:240:17 | call to getenv | shared.h:17:20:17:21 | s1 | AST only |
| globals.cpp:13:15:13:20 | call to getenv | globals.cpp:13:5:13:11 | global1 | AST only |
| globals.cpp:23:15:23:20 | call to getenv | globals.cpp:23:5:23:11 | global2 | AST only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:43:78:43:104 | (unnamed parameter 0) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:44:176:44:178 | str | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:62:7:62:12 | source | AST only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:63:30:63:30 | s | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:64:36:64:36 | s | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:70:16:70:24 | call to basic_string | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:74:7:74:7 | (const string)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:74:7:74:7 | (reference to) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:74:7:74:7 | c | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:76:7:76:7 | (const basic_string<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:76:7:76:7 | c | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:82:16:82:24 | call to basic_string | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:85:6:85:6 | call to operator<< | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:85:6:85:17 | (reference dereference) | IR only |
@@ -53,26 +105,49 @@
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:87:9:87:16 | (const char *)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:87:18:87:18 | call to operator<< | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:87:18:87:26 | (reference dereference) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:6:88:6 | call to operator<< | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:6:88:10 | (reference dereference) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:9:88:9 | (const basic_string<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:9:88:9 | (reference to) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:88:9:88:9 | t | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:91:7:91:9 | (const stringstream)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:91:7:91:9 | (reference to) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:91:7:91:9 | ss2 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:93:7:93:9 | (const stringstream)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:93:7:93:9 | (reference to) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:93:7:93:9 | ss4 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:94:7:94:9 | (const stringstream)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:94:7:94:9 | (reference to) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:94:7:94:9 | ss5 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:96:7:96:9 | (const basic_stringstream<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:96:7:96:9 | ss2 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:98:7:98:9 | (const basic_stringstream<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:98:7:98:9 | ss4 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:99:7:99:9 | (const basic_stringstream<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:99:7:99:9 | ss5 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:117:7:117:16 | user_input | AST only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:125:16:125:28 | call to basic_string | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:126:7:126:11 | (const basic_string<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:126:7:126:11 | path1 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:128:9:128:13 | path2 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:129:10:129:21 | call to basic_string | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:129:10:129:21 | temporary object | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:130:7:130:11 | (const basic_string<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:130:7:130:11 | path2 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:132:15:132:27 | call to basic_string | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:133:7:133:11 | (const basic_string<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:133:7:133:11 | path3 | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:141:17:141:19 | call to basic_string | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:144:7:144:8 | (const string)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:144:7:144:8 | (reference to) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:144:7:144:8 | ss | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:152:17:152:19 | call to basic_string | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:155:7:155:8 | (const basic_string<char, char_traits<char>, allocator<char>>)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:155:7:155:8 | ss | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:157:7:157:8 | cs | AST only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:158:7:158:8 | (const string)... | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:158:7:158:8 | (reference to) | IR only |
| stl.cpp:62:25:62:30 | call to getenv | stl.cpp:158:7:158:8 | ss | IR only |
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:11:104:20 | (...) | IR only |
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:36:24:36:24 | p | AST only |
| test_diff.cpp:111:10:111:13 | argv | shared.h:5:23:5:31 | sinkparam | AST only |

28
cpp/ql/test/library-tests/dataflow/fields/A.cpp
View File

@@ -40,21 +40,21 @@ public:
cc.insert(nullptr);
ct.insert(new C());
sink(&cc); // no flow
sink(&ct); // $ast $f-:ir
sink(&ct); // $ ast MISSING: ir
}
void f1()
{
C *c = new C();
B *b = B::make(c);
sink(b->c); // $ast $f-:ir
sink(b->c); // $ast MISSING: ir
}
void f2()
{
B *b = new B();
b->set(new C1());
sink(b->get()); // $ast $ir=55:12
sink((new B(new C()))->get()); // $ast $ir
sink(b->get()); // $ ast ir=55:12
sink((new B(new C()))->get()); // $ ast ir
}
void f3()
@@ -63,7 +63,7 @@ public:
B *b2;
b2 = setOnB(b1, new C2());
sink(b1->c); // no flow
sink(b2->c); // $ast $f-:ir
sink(b2->c); // $ ast MISSING: ir
}
void f4()
@@ -72,7 +72,7 @@ public:
B *b2;
b2 = setOnBWrap(b1, new C2());
sink(b1->c); // no flow
sink(b2->c); // $ast $f-:ir
sink(b2->c); // $ ast MISSING: ir
}
B *setOnBWrap(B *b1, C *c)
@@ -104,7 +104,7 @@ public:
{
if (C1 *c1 = dynamic_cast<C1 *>(c))
{
sink(c1->a); // $ast,ir
sink(c1->a); // $ ast,ir
}
C *cc;
if (C2 *c2 = dynamic_cast<C2 *>(c))
@@ -117,7 +117,7 @@ public:
}
if (C1 *c1 = dynamic_cast<C1 *>(cc))
{
sink(c1->a); //$f+:ast
sink(c1->a); // $ SPURIOUS: ast
}
}
@@ -129,7 +129,7 @@ public:
{
B *b = new B();
f7(b);
sink(b->c); // $ast,ir
sink(b->c); // $ ast,ir
}
class D
@@ -149,9 +149,9 @@ public:
{
B *b = new B();
D *d = new D(b, r());
sink(d->b); // $ast,ir=143:25 $ast,ir=150:12
sink(d->b->c); // $ast $f-:ir
sink(b->c); // $ast,ir
sink(d->b); // $ ast,ir=143:25 ast,ir=150:12
sink(d->b->c); // $ ast MISSING: ir
sink(b->c); // $ ast,ir
}
void f10()
@@ -162,11 +162,11 @@ public:
MyList *l3 = new MyList(nullptr, l2);
sink(l3->head); // no flow, b is nested beneath at least one ->next
sink(l3->next->head); // no flow
sink(l3->next->next->head); // $ast $f-:ir
sink(l3->next->next->head); // $ ast MISSING: ir
sink(l3->next->next->next->head); // no flow
for (MyList *l = l3; l != nullptr; l = l->next)
{
sink(l->head); // $ast $f-:ir
sink(l->head); // $ ast MISSING: ir
}
}

4
cpp/ql/test/library-tests/dataflow/fields/B.cpp
View File

@@ -6,7 +6,7 @@ class B
Elem *e = new Elem();
Box1 *b1 = new Box1(e, nullptr);
Box2 *b2 = new Box2(b1);
sink(b2->box1->elem1); // $ast $f-:ir
sink(b2->box1->elem1); // $ ast MISSING: ir
sink(b2->box1->elem2); // no flow
}
@@ -16,7 +16,7 @@ class B
Box1 *b1 = new B::Box1(nullptr, e);
Box2 *b2 = new Box2(b1);
sink(b2->box1->elem1); // no flow
sink(b2->box1->elem2); // $ast $f-:ir
sink(b2->box1->elem2); // $ ast MISSING: ir
}
static void sink(void *o) {}

8
cpp/ql/test/library-tests/dataflow/fields/C.cpp
View File

@@ -26,10 +26,10 @@ public:
void func()
{
sink(s1); // $ast $ir
sink(s2); // $f-:ast $f-:ir
sink(s3); // $ast $ir
sink(s4); // $f-:ast $f-:ir
sink(s1); // $ast ir
sink(s2); // $ MISSING: ast,ir
sink(s3); // $ast ir
sink(s4); // $ MISSING: ast,ir
}
static void sink(const void *o) {}

4
cpp/ql/test/library-tests/dataflow/fields/D.cpp
View File

@@ -19,7 +19,7 @@ public:
};
static void sinkWrap(Box2* b2) {
sink(b2->getBox1()->getElem()); // $ast=28:15 $ast=35:15 $ast=42:15 $ast=49:15 $f-:ir
sink(b2->getBox1()->getElem()); // $ast=28:15 ast=35:15 ast=42:15 ast=49:15 MISSING: ir
}
Box2* boxfield;
@@ -61,6 +61,6 @@ public:
private:
void f5b() {
sink(boxfield->box->elem); // $ast $f-:ir
sink(boxfield->box->elem); // $ ast MISSING: ir
}
};

6
cpp/ql/test/library-tests/dataflow/fields/E.cpp
View File

@@ -18,7 +18,7 @@ void sink(char *b);
void handlePacket(packet *p)
{
sink(p->data.buffer); // $ast $f-:ir
sink(p->data.buffer); // $ ast MISSING: ir
}
void f(buf* b)
@@ -28,7 +28,7 @@ void f(buf* b)
argument_source(raw);
argument_source(b->buffer);
argument_source(p.data.buffer);
sink(raw); // $ast $f-:ir
sink(b->buffer); // $ast $f-:ir
sink(raw); // $ ast MISSING: ir
sink(b->buffer); // $ ast MISSING: ir
handlePacket(&p);
}

38
cpp/ql/test/library-tests/dataflow/fields/aliasing.cpp
View File

@@ -26,8 +26,8 @@ void callSetters() {
referenceSetter(s2);
copySetter(s3);
sink(s1.m1); // $ast,ir
sink(s2.m1); // $ast,ir
sink(s1.m1); // $ ast,ir
sink(s2.m1); // $ ast,ir
sink(s3.m1); // no flow
}
@@ -35,12 +35,12 @@ void assignAfterAlias() {
S s1 = { 0, 0 };
S &ref1 = s1;
ref1.m1 = user_input();
sink(s1.m1); // $f-:ast $ir
sink(s1.m1); // $ ir MISSING: ast
S s2 = { 0, 0 };
S &ref2 = s2;
s2.m1 = user_input();
sink(ref2.m1); // $f-:ast $ir
sink(ref2.m1); // $ ir MISSING: ast
}
void assignAfterCopy() {
@@ -59,7 +59,7 @@ void assignBeforeCopy() {
S s2 = { 0, 0 };
s2.m1 = user_input();
S copy2 = s2;
sink(copy2.m1); // $ast,ir
sink(copy2.m1); // $ ast,ir
}
struct Wrapper {
@@ -77,20 +77,20 @@ void pointerIntermediate() {
Wrapper w = { { 0, 0 } };
S *s = &w.s;
s->m1 = user_input();
sink(w.s.m1); // $f-:ast $ir
sink(w.s.m1); // $ ir MISSING: ast
}
void referenceIntermediate() {
Wrapper w = { { 0, 0 } };
S &s = w.s;
s.m1 = user_input();
sink(w.s.m1); // $f-:ast $ir
sink(w.s.m1); // $ ir MISSING: ast
}
void nestedAssign() {
Wrapper w = { { 0, 0 } };
w.s.m1 = user_input();
sink(w.s.m1); // $ast,ir
sink(w.s.m1); // $ ast,ir
}
void addressOfField() {
@@ -99,7 +99,7 @@ void addressOfField() {
S s_copy = s;
int* px = &s_copy.m1;
sink(*px); // $f-:ast $ir
sink(*px); // $ ir MISSING: ast
}
void taint_a_ptr(int* pa) {
@@ -119,28 +119,28 @@ struct S_with_pointer {
void pointer_deref(int* xs) {
taint_a_ptr(xs);
sink(xs[0]); // $f-:ast $ir
sink(xs[0]); // $ ir MISSING: ast
}
void pointer_deref_sub(int* xs) {
taint_a_ptr(xs - 2);
sink(*(xs - 2)); // $f-:ast $ir
sink(*(xs - 2)); // $ ir MISSING: ast
}
void pointer_many_addrof_and_deref(int* xs) {
taint_a_ptr(xs);
sink(*&*&*xs); // $f-:ast $ir
sink(*&*&*xs); // $ ir MISSING: ast
}
void pointer_unary_plus(int* xs) {
taint_a_ptr(+xs);
sink(*+xs); // $f-:ast $ir
sink(*+xs); // $ ir MISSING: ast
}
void pointer_member_index(S_with_pointer s) {
taint_a_ptr(s.data);
// `s.data` is points to all-aliased-memory
sink(s.data[0]); // $f-:ast,ir
sink(s.data[0]); // $ MISSING: ir,ast
}
void member_array_different_field(S_with_pointer* s) {
@@ -156,13 +156,13 @@ struct S_with_array {
void pointer_member_deref() {
S_with_array s;
taint_a_ptr(s.data);
sink(*s.data); // $ir,ast
sink(*s.data); // $ ir,ast
}
void array_member_deref() {
S_with_array s;
taint_a_ptr(s.data);
sink(s.data[0]); // $ir,ast
sink(s.data[0]); // $ ir,ast
}
struct S2 {
@@ -173,7 +173,7 @@ struct S2 {
void deep_member_field_dot() {
S2 s2;
taint_a_ptr(&s2.s.m1);
sink(s2.s.m1); // $ir,ast
sink(s2.s.m1); // $ ir,ast
}
void deep_member_field_dot_different_fields() {
@@ -186,7 +186,7 @@ void deep_member_field_dot_2() {
S2 s2;
taint_a_ptr(&s2.s.m1);
S2 s2_2 = s2;
sink(s2_2.s.m1); // $ir,ast
sink(s2_2.s.m1); // $ ir,ast
}
void deep_member_field_dot_different_fields_2() {
@@ -198,7 +198,7 @@ void deep_member_field_dot_different_fields_2() {
void deep_member_field_arrow(S2 *ps2) {
taint_a_ptr(&ps2->s.m1);
sink(ps2->s.m1); // $ir,ast
sink(ps2->s.m1); // $ ir,ast
}
void deep_member_field_arrow_different_fields(S2 *ps2) {

22
cpp/ql/test/library-tests/dataflow/fields/arrays.cpp
View File

@@ -4,17 +4,17 @@ void *user_input(void);
void local_array() {
void *arr[10] = { 0 };
arr[0] = user_input();
sink(arr[0]); // $ast,ir
sink(arr[1]); // $f+:ast
sink(*arr); // $ast,ir
sink(*&arr[0]); // $ast,ir
sink(arr[0]); // $ ast,ir
sink(arr[1]); // $ SPURIOUS: ast
sink(*arr); // $ ast,ir
sink(*&arr[0]); // $ ast,ir
}
void local_array_convoluted_assign() {
void *arr[10] = { 0 };
*&arr[0] = user_input();
sink(arr[0]); // $ast,ir
sink(arr[1]); // $f+:ast
sink(arr[0]); // $ ast,ir
sink(arr[1]); // $ SPURIOUS: ast
}
struct inner {
@@ -34,18 +34,18 @@ struct outer {
void nested_array_1(outer o) {
o.nested.arr[1].data = user_input();
sink(o.nested.arr[1].data); // $ast,ir
sink(o.nested.arr[0].data); // $f+:ast
sink(o.nested.arr[1].data); // $ ast,ir
sink(o.nested.arr[0].data); // $ SPURIOUS: ast
}
void nested_array_2(outer o) {
o.indirect->arr[1].data = user_input();
sink(o.indirect->arr[1].data); // $ast $f-:ir
sink(o.indirect->arr[0].data); // $f+:ast
sink(o.indirect->arr[1].data); // $ ast MISSING: ir
sink(o.indirect->arr[0].data); // $ SPURIOUS: ast
}
void nested_array_3(outer o) {
o.indirect->ptr[1].data = user_input();
sink(o.indirect->ptr[1].data); // $f-:ast,ir
sink(o.indirect->ptr[1].data); // $ MISSING: ir,ast
sink(o.indirect->ptr[0].data);
}

30
cpp/ql/test/library-tests/dataflow/fields/by_reference.cpp
View File

@@ -48,19 +48,19 @@ struct S {
void test_setDirectly() {
S s;
s.setDirectly(user_input());
sink(s.getDirectly()); // $ast $ir
sink(s.getDirectly()); // $ast ir
}
void test_setIndirectly() {
S s;
s.setIndirectly(user_input());
sink(s.getIndirectly()); // $ast $ir
sink(s.getIndirectly()); // $ast ir
}
void test_setThroughNonMember() {
S s;
s.setThroughNonMember(user_input());
sink(s.getThroughNonMember()); // $ast $ir
sink(s.getThroughNonMember()); // $ast ir
}
void test_nonMemberSetA() {
@@ -107,13 +107,13 @@ void test_outer_with_ptr(Outer *pouter) {
taint_inner_a_ptr(pouter->inner_ptr);
taint_a_ptr(&pouter->a);
sink(outer.inner_nested.a); // $ast,ir
sink(outer.inner_ptr->a); // $ast $f-:ir
sink(outer.a); // $ast,ir
sink(outer.inner_nested.a); // $ ast,ir
sink(outer.inner_ptr->a); // $ ast MISSING: ir
sink(outer.a); // $ ast,ir
sink(pouter->inner_nested.a); // $ast,ir
sink(pouter->inner_ptr->a); // $ast $f-:ir
sink(pouter->a); // $ast,ir
sink(pouter->inner_nested.a); // $ ast,ir
sink(pouter->inner_ptr->a); // $ast MISSING: ir
sink(pouter->a); // $ ast,ir
}
void test_outer_with_ref(Outer *pouter) {
@@ -127,11 +127,11 @@ void test_outer_with_ref(Outer *pouter) {
taint_inner_a_ref(*pouter->inner_ptr);
taint_a_ref(pouter->a);
sink(outer.inner_nested.a); // $ast,ir
sink(outer.inner_ptr->a); // $ast $f-:ir
sink(outer.a); // $ast,ir
sink(outer.inner_nested.a); // $ ast,ir
sink(outer.inner_ptr->a); // $ ast MISSING: ir
sink(outer.a); // $ ast,ir
sink(pouter->inner_nested.a); // $ast,ir
sink(pouter->inner_ptr->a); // $ast $f-:ir
sink(pouter->a); // $ast,ir
sink(pouter->inner_nested.a); // $ ast,ir
sink(pouter->inner_ptr->a); // $ ast MISSING: ir
sink(pouter->a); // $ ast,ir
}

4
cpp/ql/test/library-tests/dataflow/fields/complex.cpp
View File

@@ -39,8 +39,8 @@ void sink(int x)
void bar(Outer &b)
{
sink(b.inner.f.a()); // $ast=53:19 $ast=55:19 $ir=53:19 $ir=55:19
sink(b.inner.f.b()); // $ast=54:19 $ast=56:19 $ir=54:19 $ir=56:19
sink(b.inner.f.a()); // $ ast=53:19 ast=55:19 ir=53:19 ir=55:19
sink(b.inner.f.b()); // $ ast=54:19 ast=56:19 ir=54:19 ir=56:19
}
void foo()

4
cpp/ql/test/library-tests/dataflow/fields/constructors.cpp
View File

@@ -25,8 +25,8 @@ public:
void bar(Foo &f)
{
sink(f.a()); //$ast=34:11 $ast=36:11 $ir=34:11 $ir=36:11
sink(f.b()); //$ast=35:14 $ast=36:25 $ir=35:14 $ir=36:25
sink(f.a()); // $ ast=34:11 ast=36:11 ir=34:11 ir=36:11
sink(f.b()); // $ ast=35:14 ast=36:25 ir=35:14 ir=36:25
}
void foo()

12
cpp/ql/test/library-tests/dataflow/fields/qualifiers.cpp
View File

@@ -20,31 +20,31 @@ namespace qualifiers {
void assignToGetter(Outer outer) {
outer.getInner()->a = user_input();
sink(outer.inner->a); // $ast $f-:ir
sink(outer.inner->a); // $ ast MISSING: ir
}
void getterArgument1(Outer outer) {
outer.getInner()->setA(user_input());
sink(outer.inner->a); // $ast $f-:ir
sink(outer.inner->a); // $ ast MISSING: ir
}
void getterArgument2(Outer outer) {
pointerSetA(outer.getInner(), user_input());
sink(outer.inner->a); // $ast $f-:ir
sink(outer.inner->a); // $ ast MISSING: ir
}
void getterArgument2Ref(Outer outer) {
referenceSetA(*outer.getInner(), user_input());
sink(outer.inner->a); // $ast $f-:ir
sink(outer.inner->a); // $ ast MISSING: ir
}
void assignToGetterStar(Outer outer) {
(*outer.getInner()).a = user_input();
sink(outer.inner->a); // $ast $f-:ir
sink(outer.inner->a); // $ ast MISSING: ir
}
void assignToGetterAmp(Outer outer) {
(&outer)->getInner()->a = user_input();
sink(outer.inner->a); // $ast $f-:ir
sink(outer.inner->a); // $ ast MISSING: ir
}
}

6
cpp/ql/test/library-tests/dataflow/fields/realistic.cpp
View File

@@ -58,12 +58,12 @@ int main(int argc, char** argv) {
return -1;
}
memcpy(dst, foo.bar[i].baz->userInput.buffer, foo.bar[i].baz->userInput.bufferLen);
sink((void*)foo.bar[i].baz->userInput.bufferLen); // $ast $f-:ir
sink((void*)foo.bar[i].baz->userInput.bufferLen); // $ ast MISSING: ir
// There is no flow to the following two `sink` calls because the
// source is the _pointer_ returned by `user_input` rather than the
// _data_ to which it points.
sink((void*)foo.bar[i].baz->userInput.buffer); // $f-:ast,ir
sink((void*)dst); // $f-:ast,ir
sink((void*)foo.bar[i].baz->userInput.buffer); // $ MISSING: ir,ast
sink((void*)dst); // ir MISSING: ast
i++;
}
return 0;

10
cpp/ql/test/library-tests/dataflow/fields/simple.cpp
View File

@@ -25,8 +25,8 @@ public:
void bar(Foo &f)
{
sink(f.a()); //$ast=39:12 $ast=41:12 $ir=39:12 $ir=41:12
sink(f.b()); //$ast=40:12 $ast=42:12 $ir=40:12 $ir=42:12
sink(f.a()); // $ ast=39:12 ast=41:12 ir=39:12 ir=41:12
sink(f.b()); // $ ast=40:12 ast=42:12 ir=40:12 ir=42:12
}
void foo()
@@ -64,7 +64,7 @@ void single_field_test()
A a;
a.i = user_input();
A a2 = a;
sink(a2.i); //$ast,ir
sink(a2.i); //$ ast,ir
}
struct C {
@@ -81,7 +81,7 @@ struct C2
void m() {
f2.f1 = user_input();
sink(getf2f1()); //$ast,ir
sink(getf2f1()); //$ ast,ir
}
};
@@ -91,7 +91,7 @@ void single_field_test_typedef(A_typedef a)
{
a.i = user_input();
A_typedef a2 = a;
sink(a2.i); //$ast,ir
sink(a2.i); //$ ast,ir
}
} // namespace Simple

8
cpp/ql/test/library-tests/dataflow/fields/struct_init.c
View File

@@ -12,14 +12,14 @@ struct Outer {
};
void absink(struct AB *ab) {
sink(ab->a); //$ast,ir=20:20 $ast,ir=27:7 $ast=40:20 $f-:ir
sink(ab->a); //$ ast,ir=20:20 ast,ir=27:7 ast=40:20 MISSING: ir
sink(ab->b); // no flow
}
int struct_init(void) {
struct AB ab = { user_input(), 0 };
sink(ab.a); //$ast,ir
sink(ab.a); //$ ast,ir
sink(ab.b); // no flow
absink(&ab);
@@ -28,9 +28,9 @@ int struct_init(void) {
&ab,
};
sink(outer.nestedAB.a); //$ast,ir
sink(outer.nestedAB.a); //$ ast,ir
sink(outer.nestedAB.b); // no flow
sink(outer.pointerAB->a); //$ast $f-:ir
sink(outer.pointerAB->a); //$ ast MISSING: ir
sink(outer.pointerAB->b); // no flow
absink(&outer.nestedAB);

2
cpp/ql/test/library-tests/dataflow/taint-tests/copyableclass.cpp
View File

@@ -1,6 +1,6 @@
int source();
void sink(...) {};
void sink(...);
class MyCopyableClass {
public:

4
cpp/ql/test/library-tests/dataflow/taint-tests/copyableclass_declonly.cpp
View File

@@ -1,6 +1,6 @@
int source();
void sink(...) {};
void sink(...);
class MyCopyableClassDeclOnly {
public:
@@ -15,7 +15,7 @@ public:
int v;
};
void test_copyableclass()
void test_copyableclass_declonly()
{
{
MyCopyableClassDeclOnly s1(1);

2
cpp/ql/test/library-tests/dataflow/taint-tests/format.cpp
View File

@@ -30,7 +30,7 @@ int sscanf(const char *s, const char *format, ...);
// ----------
int source();
void sink(...) {};
void sink(...);
namespace string
{

301
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -262,6 +262,10 @@
| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | |
| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | |
| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | |
| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | |
| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | |
| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | |
| file://:0:0:0:0 | (unnamed parameter 0) | file://:0:0:0:0 | (unnamed parameter 0) | |
| format.cpp:16:21:16:21 | s | format.cpp:22:22:22:22 | s | |
| format.cpp:16:31:16:31 | n | format.cpp:22:25:22:25 | n | |
| format.cpp:16:46:16:51 | format | format.cpp:22:28:22:33 | format | |
@@ -2062,8 +2066,8 @@
| movableclass.cpp:15:3:15:13 | ... = ... | movableclass.cpp:15:9:15:9 | v [post update] | |
| movableclass.cpp:15:13:15:13 | 0 | movableclass.cpp:15:3:15:13 | ... = ... | |
| movableclass.cpp:16:11:16:14 | this | movableclass.cpp:16:10:16:14 | * ... | TAINT |
| movableclass.cpp:22:57:22:57 | 1 | movableclass.cpp:22:42:22:58 | call to MyMovableClass | TAINT |
| movableclass.cpp:23:55:23:60 | call to source | movableclass.cpp:23:40:23:63 | call to MyMovableClass | TAINT |
| movableclass.cpp:22:57:22:57 | 1 | movableclass.cpp:22:35:22:59 | call to MyMovableClass | TAINT |
| movableclass.cpp:23:55:23:60 | call to source | movableclass.cpp:23:33:23:64 | call to MyMovableClass | TAINT |
| movableclass.cpp:28:21:28:21 | 1 | movableclass.cpp:28:21:28:22 | call to MyMovableClass | TAINT |
| movableclass.cpp:28:21:28:22 | call to MyMovableClass | movableclass.cpp:33:8:33:9 | s1 | |
| movableclass.cpp:29:22:29:23 | call to MyMovableClass | movableclass.cpp:34:8:34:9 | s2 | |
@@ -2092,10 +2096,8 @@
| movableclass.cpp:52:8:52:31 | call to MyMovableClass | movableclass.cpp:52:3:52:4 | ref arg s2 | TAINT |
| movableclass.cpp:52:8:52:31 | call to MyMovableClass | movableclass.cpp:52:6:52:6 | call to operator= | TAINT |
| movableclass.cpp:52:23:52:28 | call to source | movableclass.cpp:52:8:52:31 | call to MyMovableClass | TAINT |
| movableclass.cpp:59:21:59:32 | call to getUnTainted | movableclass.cpp:59:21:59:35 | call to MyMovableClass | |
| movableclass.cpp:59:21:59:35 | call to MyMovableClass | movableclass.cpp:63:8:63:9 | s1 | |
| movableclass.cpp:60:21:60:30 | call to getTainted | movableclass.cpp:60:21:60:33 | call to MyMovableClass | |
| movableclass.cpp:60:21:60:33 | call to MyMovableClass | movableclass.cpp:64:8:64:9 | s2 | |
| movableclass.cpp:59:21:59:32 | call to getUnTainted | movableclass.cpp:63:8:63:9 | s1 | |
| movableclass.cpp:60:21:60:30 | call to getTainted | movableclass.cpp:64:8:64:9 | s2 | |
| movableclass.cpp:61:18:61:19 | call to MyMovableClass | movableclass.cpp:65:8:65:9 | s3 | |
| movableclass.cpp:65:13:65:18 | call to source | movableclass.cpp:65:13:65:20 | call to MyMovableClass | TAINT |
| movableclass.cpp:65:13:65:20 | call to MyMovableClass | movableclass.cpp:65:8:65:9 | ref arg s3 | TAINT |
@@ -3188,141 +3190,125 @@
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:53:292:63 | 0 | stl.h:292:46:292:64 | (no string representation) | TAINT |
| stl.h:385:9:385:9 | Unknown literal | stl.h:385:9:385:9 | constructor init of field first | TAINT |
| stl.h:385:9:385:9 | Unknown literal | stl.h:385:9:385:9 | constructor init of field second | TAINT |
| stl.h:385:9:385:9 | constructor init of field first [post-this] | stl.h:385:9:385:9 | constructor init of field second [pre-this] | |
| stl.h:385:9:385:9 | constructor init of field first [pre-this] | stl.h:385:9:385:9 | constructor init of field second [pre-this] | |
| stl.h:385:9:385:9 | this | stl.h:385:9:385:9 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:6 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:18:392:18 | x | stl.h:392:18:392:18 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:18:392:18 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:18:392:18 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:18:392:18 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:31:392:31 | y | stl.h:392:31:392:31 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:31:392:31 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:31:392:31 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:31:392:31 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:36:392:43 | call to unknown function | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:46:392:54 | call to unknown function | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:398:109:398:109 | x | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:398:109:398:109 | x | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:398:109:398:109 | x | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:398:109:398:109 | x | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:399:40:399:40 | x [inner post update] | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:399:40:399:40 | x [inner post update] | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:399:40:399:40 | x [inner post update] | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:399:40:399:40 | x [inner post update] | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:44:399:59 | call to forward | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:44:399:59 | call to forward | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:398:117:398:117 | y | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:398:117:398:117 | y | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:398:117:398:117 | y | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:398:117:398:117 | y | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:399:61:399:61 | y [inner post update] | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:399:61:399:61 | y [inner post update] | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:399:61:399:61 | y [inner post update] | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:399:61:399:61 | y [inner post update] | |
| stl.h:399:61:399:61 | y | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:61:399:61 | y | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field first | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
| stl.h:388:9:388:9 | Unknown literal | stl.h:388:9:388:9 | constructor init of field second | TAINT |
| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [post-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | constructor init of field first [pre-this] | stl.h:388:9:388:9 | constructor init of field second [pre-this] | |
| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] | |
| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] | |
| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] | |
| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] | |
| stl.h:388:9:388:9 | this | stl.h:388:9:388:9 | constructor init of field first [pre-this] | |
| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] | |
| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] | |
| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] | |
| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] | |
| stl.h:395:3:395:3 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] | |
| stl.h:395:3:395:6 | this | stl.h:395:36:395:43 | constructor init of field first [pre-this] | |
| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x | |
| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x | |
| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x | |
| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x | |
| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x | |
| stl.h:395:18:395:18 | x | stl.h:395:42:395:42 | x | |
| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y | |
| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y | |
| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y | |
| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y | |
| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y | |
| stl.h:395:31:395:31 | y | stl.h:395:53:395:53 | y | |
| stl.h:395:36:395:43 | call to unknown function | stl.h:395:36:395:43 | constructor init of field first | TAINT |
| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [post-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:36:395:43 | constructor init of field first [pre-this] | stl.h:395:46:395:54 | constructor init of field second [pre-this] | |
| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
| stl.h:395:42:395:42 | x | stl.h:395:36:395:43 | constructor init of field first | TAINT |
| stl.h:395:46:395:54 | call to unknown function | stl.h:395:46:395:54 | constructor init of field second | TAINT |
| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
| stl.h:395:53:395:53 | y | stl.h:395:46:395:54 | constructor init of field second | TAINT |
| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x | |
| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x | |
| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x | |
| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x | |
| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x | |
| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x | |
| stl.h:401:87:401:87 | x | stl.h:401:87:401:87 | x | |
| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x | |
| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x | |
| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x | |
| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x | |
| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x | |
| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x | |
| stl.h:401:87:401:87 | x | stl.h:402:58:402:58 | x | |
| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y | |
| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y | |
| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y | |
| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y | |
| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y | |
| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y | |
| stl.h:401:95:401:95 | y | stl.h:401:95:401:95 | y | |
| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y | |
| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y | |
| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y | |
| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y | |
| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y | |
| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y | |
| stl.h:401:95:401:95 | y | stl.h:402:79:402:79 | y | |
| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward | |
| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward | |
| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward | |
| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward | |
| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward | |
| stl.h:402:58:402:58 | x | stl.h:402:41:402:56 | call to forward | |
| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:62:402:77 | call to forward | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:79:402:79 | y | stl.h:402:3:402:82 | call to pair | TAINT |
| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward | |
| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward | |
| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward | |
| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward | |
| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward | |
| stl.h:402:79:402:79 | y | stl.h:402:62:402:77 | call to forward | |
| string.cpp:25:12:25:17 | call to source | string.cpp:29:7:29:7 | a | |
| string.cpp:26:16:26:20 | 123 | string.cpp:26:16:26:21 | call to basic_string | TAINT |
| string.cpp:26:16:26:21 | call to basic_string | string.cpp:30:7:30:7 | b | |
@@ -5060,16 +5046,10 @@
| swap1.cpp:56:30:56:34 | data1 | swap1.cpp:56:18:56:22 | ref arg data1 | |
| swap1.cpp:61:22:61:22 | x | swap1.cpp:61:22:61:22 | x | |
| swap1.cpp:61:22:61:22 | x | swap1.cpp:63:9:63:9 | x | |
| swap1.cpp:61:22:61:22 | x | swap2.cpp:61:22:61:22 | x | |
| swap1.cpp:61:22:61:22 | x | swap2.cpp:63:9:63:9 | x | |
| swap1.cpp:61:32:61:32 | y | swap1.cpp:61:32:61:32 | y | |
| swap1.cpp:61:32:61:32 | y | swap1.cpp:63:16:63:16 | y | |
| swap1.cpp:61:32:61:32 | y | swap2.cpp:61:32:61:32 | y | |
| swap1.cpp:61:32:61:32 | y | swap2.cpp:63:16:63:16 | y | |
| swap1.cpp:63:9:63:9 | ref arg x | swap1.cpp:61:22:61:22 | x | |
| swap1.cpp:63:9:63:9 | ref arg x | swap2.cpp:61:22:61:22 | x | |
| swap1.cpp:63:16:63:16 | ref arg y | swap1.cpp:61:32:61:32 | y | |
| swap1.cpp:63:16:63:16 | ref arg y | swap2.cpp:61:32:61:32 | y | |
| swap1.cpp:69:23:69:23 | x | swap1.cpp:71:5:71:5 | x | |
| swap1.cpp:69:23:69:23 | x | swap1.cpp:73:10:73:10 | x | |
| swap1.cpp:69:23:69:23 | x | swap1.cpp:76:9:76:9 | x | |
@@ -5230,17 +5210,11 @@
| swap2.cpp:56:50:56:53 | that | swap2.cpp:56:43:56:47 | ref arg data2 | |
| swap2.cpp:56:50:56:53 | that [post update] | swap2.cpp:53:26:53:29 | that | |
| swap2.cpp:56:55:56:59 | data2 | swap2.cpp:56:43:56:47 | ref arg data2 | |
| swap2.cpp:61:22:61:22 | x | swap1.cpp:61:22:61:22 | x | |
| swap2.cpp:61:22:61:22 | x | swap1.cpp:63:9:63:9 | x | |
| swap2.cpp:61:22:61:22 | x | swap2.cpp:61:22:61:22 | x | |
| swap2.cpp:61:22:61:22 | x | swap2.cpp:63:9:63:9 | x | |
| swap2.cpp:61:32:61:32 | y | swap1.cpp:61:32:61:32 | y | |
| swap2.cpp:61:32:61:32 | y | swap1.cpp:63:16:63:16 | y | |
| swap2.cpp:61:32:61:32 | y | swap2.cpp:61:32:61:32 | y | |
| swap2.cpp:61:32:61:32 | y | swap2.cpp:63:16:63:16 | y | |
| swap2.cpp:63:9:63:9 | ref arg x | swap1.cpp:61:22:61:22 | x | |
| swap2.cpp:63:9:63:9 | ref arg x | swap2.cpp:61:22:61:22 | x | |
| swap2.cpp:63:16:63:16 | ref arg y | swap1.cpp:61:32:61:32 | y | |
| swap2.cpp:63:16:63:16 | ref arg y | swap2.cpp:61:32:61:32 | y | |
| swap2.cpp:69:23:69:23 | x | swap2.cpp:71:5:71:5 | x | |
| swap2.cpp:69:23:69:23 | x | swap2.cpp:73:10:73:10 | x | |
@@ -7257,3 +7231,24 @@
| vector.cpp:484:29:484:33 | call to c_str | vector.cpp:484:3:484:8 | call to memcpy | TAINT |
| vector.cpp:484:29:484:33 | call to c_str | vector.cpp:484:10:484:22 | ref arg & ... | TAINT |
| vector.cpp:486:8:486:9 | ref arg cs | vector.cpp:487:2:487:2 | cs | |
| vector.cpp:491:22:491:24 | call to vector | vector.cpp:493:2:493:3 | v1 | |
| vector.cpp:491:22:491:24 | call to vector | vector.cpp:494:7:494:8 | v1 | |
| vector.cpp:491:22:491:24 | call to vector | vector.cpp:498:1:498:1 | v1 | |
| vector.cpp:491:30:491:32 | call to vector | vector.cpp:496:2:496:3 | v2 | |
| vector.cpp:491:30:491:32 | call to vector | vector.cpp:496:13:496:14 | v2 | |
| vector.cpp:491:30:491:32 | call to vector | vector.cpp:497:7:497:8 | v2 | |
| vector.cpp:491:30:491:32 | call to vector | vector.cpp:498:1:498:1 | v2 | |
| vector.cpp:493:2:493:3 | ref arg v1 | vector.cpp:494:7:494:8 | v1 | |
| vector.cpp:493:2:493:3 | ref arg v1 | vector.cpp:498:1:498:1 | v1 | |
| vector.cpp:493:18:493:23 | call to source | vector.cpp:493:2:493:3 | ref arg v1 | TAINT |
| vector.cpp:494:7:494:8 | ref arg v1 | vector.cpp:498:1:498:1 | v1 | |
| vector.cpp:496:2:496:3 | ref arg v2 | vector.cpp:497:7:497:8 | v2 | |
| vector.cpp:496:2:496:3 | ref arg v2 | vector.cpp:498:1:498:1 | v2 | |
| vector.cpp:496:13:496:14 | ref arg v2 | vector.cpp:496:2:496:3 | v2 | |
| vector.cpp:496:13:496:14 | ref arg v2 | vector.cpp:497:7:497:8 | v2 | |
| vector.cpp:496:13:496:14 | ref arg v2 | vector.cpp:498:1:498:1 | v2 | |
| vector.cpp:496:13:496:14 | v2 | vector.cpp:496:16:496:20 | call to begin | TAINT |
| vector.cpp:496:16:496:20 | call to begin | vector.cpp:496:13:496:22 | call to iterator | TAINT |
| vector.cpp:496:25:496:30 | call to source | vector.cpp:496:2:496:3 | ref arg v2 | TAINT |
| vector.cpp:496:25:496:30 | call to source | vector.cpp:496:5:496:11 | call to emplace | TAINT |
| vector.cpp:497:7:497:8 | ref arg v2 | vector.cpp:498:1:498:1 | v2 | |

8
cpp/ql/test/library-tests/dataflow/taint-tests/map.cpp
View File

@@ -2,9 +2,9 @@
#include "stl.h"
using namespace std;
namespace {
char *source();
}
void sink(char *);
void sink(const char *);
void sink(bool);
@@ -84,10 +84,10 @@ void test_pair()
sink(make_pair("123", "456").first);
sink(make_pair("123", "456").second);
sink(make_pair(source(), "456")); // tainted [NOT DETECTED]
sink(make_pair(source(), "456").first); // tainted [NOT DETECTED]
sink(make_pair(source(), "456").first); // tainted
sink(make_pair(source(), "456").second);
sink(make_pair("123", source())); // tainted
sink(make_pair("123", source()).first); // [FALSE POSITIVE]
sink(make_pair("123", source()).first);
sink(make_pair("123", source()).second); // tainted
std::pair<std::pair<char *, char *>, char *> m;

6
cpp/ql/test/library-tests/dataflow/taint-tests/movableclass.cpp
View File

@@ -19,10 +19,10 @@ public:
int v;
};
MyMovableClass &&getUnTainted() { return MyMovableClass(1); }
MyMovableClass &&getTainted() { return MyMovableClass(source()); }
MyMovableClass getUnTainted() { return MyMovableClass(1); }
MyMovableClass getTainted() { return MyMovableClass(source()); }
void test_copyableclass()
void test_movableclass()
{
{
MyMovableClass s1(1);

4
cpp/ql/test/library-tests/dataflow/taint-tests/set.cpp
View File

@@ -2,9 +2,9 @@
#include "stl.h"
using namespace std;
namespace {
char *source();
}
void sink(char *);
void sink(std::set<char *>);
void sink(std::set<char *>::iterator);

39
cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
View File

@@ -1,28 +1,28 @@
typedef unsigned long size_t;
template<class T>
struct remove_const { typedef T type; };
template<class T>
struct remove_const<const T> { typedef T type; };
// `remove_const_t<T>` removes any `const` specifier from `T`
template<class T>
using remove_const_t = typename remove_const<T>::type;
template<class T>
struct remove_reference { typedef T type; };
template<class T>
struct remove_reference<T &> { typedef T type; };
template<class T>
struct remove_reference<T &&> { typedef T type; };
// `remove_reference_t<T>` removes any `&` from `T`
template<class T>
using remove_reference_t = typename remove_reference<T>::type;
#include "type_traits.h"
namespace std
{
@@ -332,6 +332,9 @@ namespace std {
iterator insert(const_iterator position, size_type n, const T& x);
template<class InputIterator> iterator insert(const_iterator position, InputIterator first, InputIterator last);
template <class... Args> iterator emplace (const_iterator position, Args&&... args);
template <class... Args> void emplace_back (Args&&... args);
void swap(vector&) noexcept/*(allocator_traits<Allocator>::propagate_on_container_swap::value || allocator_traits<Allocator>::is_always_equal::value)*/;
void clear() noexcept;
@@ -395,8 +398,8 @@ namespace std {
void swap(pair& p) /*noexcept(...)*/;
};
template<class T1, class T2> constexpr pair<remove_reference_t<T1>, remove_reference_t<T2>> make_pair(T1&& x, T2&& y) {
return pair<T1, T2>(std::forward<T1>(x), std::forward<T2>(y));
template<class T1, class T2> constexpr pair<decay_t<T1>, decay_t<T2>> make_pair(T1&& x, T2&& y) {
return pair<decay_t<T1>, decay_t<T2>>(std::forward<T1>(x), std::forward<T2>(y));
}
}

6
cpp/ql/test/library-tests/dataflow/taint-tests/string.cpp
View File

@@ -2,9 +2,9 @@
#include "stl.h"
using namespace std;
namespace {
char *source();
}
namespace ns_char
{
char source();
@@ -499,7 +499,7 @@ void test_string_iterator_methods()
}
}
void test_constructors_more() {
void test_string_constructors_more() {
char *cs1 = "abc";
char *cs2 = source();
std::string s1(cs1);

4
cpp/ql/test/library-tests/dataflow/taint-tests/stringstream.cpp
View File

@@ -2,9 +2,9 @@
#include "stl.h"
using namespace std;
namespace {
char *source();
}
namespace ns_char
{
char source();

2
cpp/ql/test/library-tests/dataflow/taint-tests/structlikeclass.cpp
View File

@@ -1,6 +1,6 @@
int source();
void sink(...) {};
void sink(...);
class StructLikeClass {
public:

6
cpp/ql/test/library-tests/dataflow/taint-tests/swap1.cpp
View File

@@ -13,7 +13,7 @@ namespace std
template <class T>
T &&move(T &t) noexcept { return static_cast<T &&>(t); } // simplified signature (and implementation)
} // namespace std
namespace Swap1 {
namespace IntWrapper
{
struct Class
@@ -84,7 +84,7 @@ void test_copy_assignment_operator()
swap(z1, z2);
sink(z2.data1); // tainted [FALSE NEGATIVE in IR]
sink(z2.data1); // tainted
sink(z1.data1); // clean [FALSE POSITIVE]
}
@@ -144,3 +144,5 @@ void test_move_assignment_method()
sink(y.data1); // tainted
sink(x.data1); // tainted
}
}

6
cpp/ql/test/library-tests/dataflow/taint-tests/swap2.cpp
View File

@@ -13,7 +13,7 @@ namespace std
template <class T>
T &&move(T &t) noexcept { return static_cast<T &&>(t); } // simplified signature (and implementation)
} // namespace std
namespace Swap2 {
namespace IntWrapper
{
struct Class
@@ -84,7 +84,7 @@ void test_copy_assignment_operator()
swap(z1, z2);
sink(z2.data1); // tainted [FALSE NEGATIVE in IR]
sink(z2.data1); // tainted
sink(z1.data1); // clean [FALSE POSITIVE]
}
@@ -144,3 +144,5 @@ void test_move_assignment_method()
sink(y.data1); // tainted
sink(x.data1); // tainted
}
}

2
cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
View File

@@ -1,5 +1,5 @@
int source();
void sink(...) {};
void sink(...);
void arithAssignments(int source1, int clean1) {
sink(clean1); // clean

4
cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
View File

@@ -48,7 +48,9 @@
| map.cpp:77:9:77:14 | second | map.cpp:66:37:66:42 | call to source |
| map.cpp:78:7:78:7 | k | map.cpp:66:37:66:42 | call to source |
| map.cpp:81:7:81:7 | l | map.cpp:66:37:66:42 | call to source |
| map.cpp:87:34:87:38 | first | map.cpp:87:17:87:22 | call to source |
| map.cpp:89:7:89:32 | call to pair | map.cpp:89:24:89:29 | call to source |
| map.cpp:91:34:91:39 | second | map.cpp:91:24:91:29 | call to source |
| map.cpp:110:10:110:15 | call to insert | map.cpp:110:62:110:67 | call to source |
| map.cpp:112:10:112:25 | call to insert_or_assign | map.cpp:112:46:112:51 | call to source |
| map.cpp:114:7:114:8 | call to map | map.cpp:108:39:108:44 | call to source |
@@ -666,3 +668,5 @@
| vector.cpp:482:8:482:10 | src | vector.cpp:478:21:478:37 | call to source |
| vector.cpp:485:8:485:10 | src | vector.cpp:478:21:478:37 | call to source |
| vector.cpp:486:8:486:9 | cs | vector.cpp:478:21:478:37 | call to source |
| vector.cpp:494:7:494:8 | v1 | vector.cpp:493:18:493:23 | call to source |
| vector.cpp:497:7:497:8 | v2 | vector.cpp:496:25:496:30 | call to source |

150
cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
View File

@@ -15,7 +15,6 @@
| arrayassignment.cpp:146:7:146:13 | arrayassignment.cpp:144:12:144:17 | IR only |
| copyableclass.cpp:67:11:67:11 | copyableclass.cpp:67:13:67:18 | AST only |
| copyableclass.cpp:67:11:67:21 | copyableclass.cpp:67:13:67:18 | IR only |
| copyableclass_declonly.cpp:42:8:42:9 | copyableclass_declonly.cpp:34:30:34:35 | AST only |
| copyableclass_declonly.cpp:67:11:67:11 | copyableclass_declonly.cpp:67:13:67:18 | AST only |
| map.cpp:49:9:49:13 | map.cpp:48:37:48:42 | IR only |
| map.cpp:54:9:54:13 | map.cpp:48:37:48:42 | IR only |
@@ -27,22 +26,8 @@
| map.cpp:79:9:79:13 | map.cpp:66:37:66:42 | IR only |
| map.cpp:80:9:80:14 | map.cpp:66:37:66:42 | IR only |
| map.cpp:90:34:90:38 | map.cpp:90:24:90:29 | IR only |
| map.cpp:91:34:91:39 | map.cpp:91:24:91:29 | IR only |
| map.cpp:108:7:108:54 | map.cpp:108:39:108:44 | IR only |
| map.cpp:111:7:111:48 | map.cpp:111:34:111:39 | IR only |
| map.cpp:114:7:114:8 | map.cpp:108:39:108:44 | AST only |
| map.cpp:116:7:116:8 | map.cpp:110:62:110:67 | AST only |
| map.cpp:117:7:117:8 | map.cpp:111:34:111:39 | AST only |
| map.cpp:118:7:118:8 | map.cpp:112:46:112:51 | AST only |
| map.cpp:123:10:123:13 | map.cpp:111:34:111:39 | AST only |
| map.cpp:124:10:124:13 | map.cpp:112:46:112:51 | AST only |
| map.cpp:129:10:129:13 | map.cpp:111:34:111:39 | AST only |
| map.cpp:130:10:130:13 | map.cpp:112:46:112:51 | AST only |
| map.cpp:137:7:137:8 | map.cpp:108:39:108:44 | AST only |
| map.cpp:138:7:138:8 | map.cpp:108:39:108:44 | AST only |
| map.cpp:139:7:139:8 | map.cpp:108:39:108:44 | AST only |
| map.cpp:140:10:140:13 | map.cpp:108:39:108:44 | AST only |
| map.cpp:141:10:141:13 | map.cpp:108:39:108:44 | AST only |
| map.cpp:155:12:155:16 | map.cpp:108:39:108:44 | IR only |
| map.cpp:156:12:156:17 | map.cpp:108:39:108:44 | IR only |
| map.cpp:161:12:161:16 | map.cpp:108:39:108:44 | IR only |
@@ -52,44 +37,10 @@
| map.cpp:184:7:184:31 | map.cpp:108:39:108:44 | IR only |
| map.cpp:185:7:185:32 | map.cpp:108:39:108:44 | IR only |
| map.cpp:187:7:187:32 | map.cpp:108:39:108:44 | IR only |
| map.cpp:193:7:193:9 | map.cpp:191:49:191:54 | AST only |
| map.cpp:196:7:196:9 | map.cpp:192:49:192:54 | AST only |
| map.cpp:199:7:199:9 | map.cpp:191:49:191:54 | AST only |
| map.cpp:200:7:200:9 | map.cpp:191:49:191:54 | AST only |
| map.cpp:201:7:201:9 | map.cpp:192:49:192:54 | AST only |
| map.cpp:202:7:202:9 | map.cpp:192:49:192:54 | AST only |
| map.cpp:210:7:210:9 | map.cpp:206:49:206:54 | AST only |
| map.cpp:213:7:213:9 | map.cpp:209:49:209:54 | AST only |
| map.cpp:216:7:216:9 | map.cpp:206:49:206:54 | AST only |
| map.cpp:218:7:218:9 | map.cpp:209:49:209:54 | AST only |
| map.cpp:219:7:219:9 | map.cpp:209:49:209:54 | AST only |
| map.cpp:225:7:225:9 | map.cpp:223:49:223:54 | AST only |
| map.cpp:225:7:225:9 | map.cpp:224:49:224:54 | AST only |
| map.cpp:227:7:227:9 | map.cpp:223:49:223:54 | AST only |
| map.cpp:227:7:227:9 | map.cpp:224:49:224:54 | AST only |
| map.cpp:229:7:229:9 | map.cpp:223:49:223:54 | AST only |
| map.cpp:229:7:229:9 | map.cpp:224:49:224:54 | AST only |
| map.cpp:235:7:235:40 | map.cpp:235:26:235:31 | IR only |
| map.cpp:236:7:236:9 | map.cpp:235:26:235:31 | AST only |
| map.cpp:240:7:240:9 | map.cpp:239:44:239:49 | AST only |
| map.cpp:246:7:246:44 | map.cpp:246:30:246:35 | IR only |
| map.cpp:247:7:247:9 | map.cpp:246:30:246:35 | AST only |
| map.cpp:251:7:251:9 | map.cpp:250:43:250:48 | AST only |
| map.cpp:260:7:260:54 | map.cpp:260:39:260:44 | IR only |
| map.cpp:263:7:263:48 | map.cpp:263:34:263:39 | IR only |
| map.cpp:266:7:266:8 | map.cpp:260:39:260:44 | AST only |
| map.cpp:268:7:268:8 | map.cpp:262:62:262:67 | AST only |
| map.cpp:269:7:269:8 | map.cpp:263:34:263:39 | AST only |
| map.cpp:270:7:270:8 | map.cpp:264:46:264:51 | AST only |
| map.cpp:275:10:275:13 | map.cpp:263:34:263:39 | AST only |
| map.cpp:276:10:276:13 | map.cpp:264:46:264:51 | AST only |
| map.cpp:281:10:281:13 | map.cpp:263:34:263:39 | AST only |
| map.cpp:282:10:282:13 | map.cpp:264:46:264:51 | AST only |
| map.cpp:289:7:289:8 | map.cpp:260:39:260:44 | AST only |
| map.cpp:290:7:290:8 | map.cpp:260:39:260:44 | AST only |
| map.cpp:291:7:291:8 | map.cpp:260:39:260:44 | AST only |
| map.cpp:292:10:292:13 | map.cpp:260:39:260:44 | AST only |
| map.cpp:293:10:293:13 | map.cpp:260:39:260:44 | AST only |
| map.cpp:307:12:307:16 | map.cpp:260:39:260:44 | IR only |
| map.cpp:308:12:308:17 | map.cpp:260:39:260:44 | IR only |
| map.cpp:313:12:313:16 | map.cpp:260:39:260:44 | IR only |
@@ -99,105 +50,25 @@
| map.cpp:334:7:334:31 | map.cpp:260:39:260:44 | IR only |
| map.cpp:335:7:335:32 | map.cpp:260:39:260:44 | IR only |
| map.cpp:336:7:336:32 | map.cpp:260:39:260:44 | IR only |
| map.cpp:342:7:342:9 | map.cpp:340:49:340:54 | AST only |
| map.cpp:345:7:345:9 | map.cpp:341:49:341:54 | AST only |
| map.cpp:348:7:348:9 | map.cpp:340:49:340:54 | AST only |
| map.cpp:349:7:349:9 | map.cpp:340:49:340:54 | AST only |
| map.cpp:350:7:350:9 | map.cpp:341:49:341:54 | AST only |
| map.cpp:351:7:351:9 | map.cpp:341:49:341:54 | AST only |
| map.cpp:359:7:359:9 | map.cpp:355:49:355:54 | AST only |
| map.cpp:362:7:362:9 | map.cpp:358:49:358:54 | AST only |
| map.cpp:365:7:365:9 | map.cpp:355:49:355:54 | AST only |
| map.cpp:367:7:367:9 | map.cpp:358:49:358:54 | AST only |
| map.cpp:368:7:368:9 | map.cpp:358:49:358:54 | AST only |
| map.cpp:374:7:374:9 | map.cpp:372:49:372:54 | AST only |
| map.cpp:374:7:374:9 | map.cpp:373:49:373:54 | AST only |
| map.cpp:376:7:376:9 | map.cpp:372:49:372:54 | AST only |
| map.cpp:376:7:376:9 | map.cpp:373:49:373:54 | AST only |
| map.cpp:378:7:378:9 | map.cpp:372:49:372:54 | AST only |
| map.cpp:378:7:378:9 | map.cpp:373:49:373:54 | AST only |
| map.cpp:384:7:384:40 | map.cpp:384:26:384:31 | IR only |
| map.cpp:385:7:385:9 | map.cpp:384:26:384:31 | AST only |
| map.cpp:389:7:389:9 | map.cpp:388:44:388:49 | AST only |
| map.cpp:396:7:396:44 | map.cpp:396:30:396:35 | IR only |
| map.cpp:397:40:397:45 | map.cpp:396:30:396:35 | IR only |
| map.cpp:397:40:397:45 | map.cpp:397:30:397:35 | IR only |
| map.cpp:398:7:398:9 | map.cpp:396:30:396:35 | AST only |
| map.cpp:398:7:398:9 | map.cpp:397:30:397:35 | AST only |
| map.cpp:402:7:402:9 | map.cpp:401:43:401:48 | AST only |
| map.cpp:417:7:417:9 | map.cpp:416:30:416:35 | AST only |
| map.cpp:418:7:418:16 | map.cpp:416:30:416:35 | AST only |
| map.cpp:420:7:420:9 | map.cpp:419:33:419:38 | AST only |
| map.cpp:421:7:421:16 | map.cpp:419:33:419:38 | AST only |
| map.cpp:431:7:431:67 | map.cpp:431:52:431:57 | IR only |
| map.cpp:432:7:432:9 | map.cpp:431:52:431:57 | AST only |
| movableclass.cpp:65:11:65:11 | movableclass.cpp:65:13:65:18 | AST only |
| movableclass.cpp:65:11:65:21 | movableclass.cpp:65:13:65:18 | IR only |
| set.cpp:20:7:20:31 | set.cpp:20:17:20:22 | IR only |
| set.cpp:26:7:26:8 | set.cpp:20:17:20:22 | AST only |
| set.cpp:28:7:28:8 | set.cpp:22:29:22:34 | AST only |
| set.cpp:30:7:30:8 | set.cpp:20:17:20:22 | AST only |
| set.cpp:44:7:44:8 | set.cpp:20:17:20:22 | AST only |
| set.cpp:45:7:45:8 | set.cpp:20:17:20:22 | AST only |
| set.cpp:46:7:46:8 | set.cpp:20:17:20:22 | AST only |
| set.cpp:47:7:47:9 | set.cpp:20:17:20:22 | AST only |
| set.cpp:48:10:48:13 | set.cpp:20:17:20:22 | AST only |
| set.cpp:49:10:49:13 | set.cpp:20:17:20:22 | AST only |
| set.cpp:61:8:61:11 | set.cpp:20:17:20:22 | IR only |
| set.cpp:71:7:71:32 | set.cpp:67:13:67:18 | IR only |
| set.cpp:72:7:72:33 | set.cpp:67:13:67:18 | IR only |
| set.cpp:78:7:78:9 | set.cpp:76:13:76:18 | AST only |
| set.cpp:81:7:81:9 | set.cpp:77:13:77:18 | AST only |
| set.cpp:84:7:84:9 | set.cpp:76:13:76:18 | AST only |
| set.cpp:85:7:85:9 | set.cpp:76:13:76:18 | AST only |
| set.cpp:86:7:86:9 | set.cpp:77:13:77:18 | AST only |
| set.cpp:87:7:87:9 | set.cpp:77:13:77:18 | AST only |
| set.cpp:95:7:95:9 | set.cpp:91:13:91:18 | AST only |
| set.cpp:98:7:98:9 | set.cpp:94:13:94:18 | AST only |
| set.cpp:101:7:101:9 | set.cpp:91:13:91:18 | AST only |
| set.cpp:103:7:103:9 | set.cpp:94:13:94:18 | AST only |
| set.cpp:104:7:104:9 | set.cpp:94:13:94:18 | AST only |
| set.cpp:110:7:110:9 | set.cpp:108:13:108:18 | AST only |
| set.cpp:110:7:110:9 | set.cpp:109:13:109:18 | AST only |
| set.cpp:112:7:112:9 | set.cpp:108:13:108:18 | AST only |
| set.cpp:112:7:112:9 | set.cpp:109:13:109:18 | AST only |
| set.cpp:114:7:114:9 | set.cpp:108:13:108:18 | AST only |
| set.cpp:114:7:114:9 | set.cpp:109:13:109:18 | AST only |
| set.cpp:120:7:120:33 | set.cpp:120:19:120:24 | IR only |
| set.cpp:121:7:121:9 | set.cpp:120:19:120:24 | AST only |
| set.cpp:125:7:125:9 | set.cpp:124:37:124:42 | AST only |
| set.cpp:134:7:134:31 | set.cpp:134:17:134:22 | IR only |
| set.cpp:140:7:140:8 | set.cpp:134:17:134:22 | AST only |
| set.cpp:142:7:142:8 | set.cpp:136:29:136:34 | AST only |
| set.cpp:144:7:144:8 | set.cpp:134:17:134:22 | AST only |
| set.cpp:158:7:158:8 | set.cpp:134:17:134:22 | AST only |
| set.cpp:159:7:159:8 | set.cpp:134:17:134:22 | AST only |
| set.cpp:160:7:160:8 | set.cpp:134:17:134:22 | AST only |
| set.cpp:161:7:161:9 | set.cpp:134:17:134:22 | AST only |
| set.cpp:162:10:162:13 | set.cpp:134:17:134:22 | AST only |
| set.cpp:163:10:163:13 | set.cpp:134:17:134:22 | AST only |
| set.cpp:175:8:175:11 | set.cpp:134:17:134:22 | IR only |
| set.cpp:183:7:183:32 | set.cpp:181:13:181:18 | IR only |
| set.cpp:184:7:184:33 | set.cpp:181:13:181:18 | IR only |
| set.cpp:190:7:190:9 | set.cpp:188:13:188:18 | AST only |
| set.cpp:193:7:193:9 | set.cpp:189:13:189:18 | AST only |
| set.cpp:196:7:196:9 | set.cpp:188:13:188:18 | AST only |
| set.cpp:197:7:197:9 | set.cpp:188:13:188:18 | AST only |
| set.cpp:198:7:198:9 | set.cpp:189:13:189:18 | AST only |
| set.cpp:199:7:199:9 | set.cpp:189:13:189:18 | AST only |
| set.cpp:207:7:207:9 | set.cpp:203:13:203:18 | AST only |
| set.cpp:210:7:210:9 | set.cpp:206:13:206:18 | AST only |
| set.cpp:213:7:213:9 | set.cpp:203:13:203:18 | AST only |
| set.cpp:215:7:215:9 | set.cpp:206:13:206:18 | AST only |
| set.cpp:216:7:216:9 | set.cpp:206:13:206:18 | AST only |
| set.cpp:222:7:222:9 | set.cpp:220:13:220:18 | AST only |
| set.cpp:222:7:222:9 | set.cpp:221:13:221:18 | AST only |
| set.cpp:224:7:224:9 | set.cpp:220:13:220:18 | AST only |
| set.cpp:224:7:224:9 | set.cpp:221:13:221:18 | AST only |
| set.cpp:226:7:226:9 | set.cpp:220:13:220:18 | AST only |
| set.cpp:226:7:226:9 | set.cpp:221:13:221:18 | AST only |
| set.cpp:232:7:232:33 | set.cpp:232:19:232:24 | IR only |
| set.cpp:233:7:233:9 | set.cpp:232:19:232:24 | AST only |
| set.cpp:237:7:237:9 | set.cpp:236:37:236:42 | AST only |
| smart_pointer.cpp:12:10:12:10 | smart_pointer.cpp:11:52:11:57 | AST only |
| smart_pointer.cpp:24:10:24:10 | smart_pointer.cpp:23:52:23:57 | AST only |
| standalone_iterators.cpp:41:10:41:10 | standalone_iterators.cpp:39:45:39:51 | AST only |
@@ -211,6 +82,10 @@
| string.cpp:46:13:46:17 | string.cpp:14:10:14:15 | AST only |
| string.cpp:70:7:70:8 | string.cpp:62:19:62:24 | AST only |
| string.cpp:126:8:126:11 | string.cpp:120:16:120:21 | IR only |
| string.cpp:145:8:145:14 | string.cpp:142:18:142:23 | IR only |
| string.cpp:146:8:146:14 | string.cpp:142:18:142:23 | IR only |
| string.cpp:147:8:147:14 | string.cpp:142:18:142:23 | IR only |
| string.cpp:150:8:150:20 | string.cpp:150:13:150:18 | IR only |
| string.cpp:162:11:162:11 | string.cpp:155:18:155:23 | AST only |
| string.cpp:166:11:166:11 | string.cpp:166:14:166:19 | AST only |
| string.cpp:167:11:167:11 | string.cpp:166:14:166:19 | AST only |
@@ -223,6 +98,7 @@
| string.cpp:247:10:247:16 | string.cpp:234:17:234:22 | AST only |
| string.cpp:251:10:251:16 | string.cpp:235:11:235:25 | AST only |
| string.cpp:312:9:312:12 | string.cpp:309:16:309:21 | AST only |
| string.cpp:323:7:323:29 | string.cpp:320:16:320:21 | IR only |
| string.cpp:340:7:340:7 | string.cpp:336:9:336:23 | AST only |
| string.cpp:341:7:341:7 | string.cpp:337:12:337:26 | AST only |
| string.cpp:342:7:342:7 | string.cpp:336:9:336:23 | AST only |
@@ -231,8 +107,8 @@
| string.cpp:363:11:363:16 | string.cpp:358:18:358:23 | AST only |
| string.cpp:382:8:382:14 | string.cpp:374:18:374:23 | IR only |
| string.cpp:383:13:383:15 | string.cpp:374:18:374:23 | IR only |
| string.cpp:396:8:396:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:397:8:397:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:396:8:396:15 | string.cpp:389:18:389:23 | IR only |
| string.cpp:397:8:397:15 | string.cpp:389:18:389:23 | IR only |
| string.cpp:399:8:399:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:401:8:401:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:404:8:404:11 | string.cpp:389:18:389:23 | IR only |
@@ -241,9 +117,7 @@
| string.cpp:411:8:411:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:415:8:415:11 | string.cpp:389:18:389:23 | IR only |
| string.cpp:418:8:418:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:419:8:419:10 | string.cpp:389:18:389:23 | AST only |
| string.cpp:421:8:421:8 | string.cpp:389:18:389:23 | AST only |
| string.cpp:422:8:422:10 | string.cpp:389:18:389:23 | AST only |
| string.cpp:436:10:436:15 | string.cpp:431:14:431:19 | AST only |
| string.cpp:449:10:449:15 | string.cpp:449:32:449:46 | AST only |
| string.cpp:462:10:462:15 | string.cpp:457:18:457:23 | AST only |
@@ -268,7 +142,9 @@
| stringstream.cpp:35:11:35:11 | stringstream.cpp:29:16:29:21 | AST only |
| stringstream.cpp:39:7:39:9 | stringstream.cpp:33:23:33:28 | AST only |
| stringstream.cpp:41:7:41:9 | stringstream.cpp:29:16:29:21 | AST only |
| stringstream.cpp:43:7:43:15 | stringstream.cpp:32:14:32:19 | IR only |
| stringstream.cpp:44:11:44:13 | stringstream.cpp:33:23:33:28 | AST only |
| stringstream.cpp:45:7:45:15 | stringstream.cpp:34:14:34:19 | IR only |
| stringstream.cpp:46:11:46:13 | stringstream.cpp:29:16:29:21 | AST only |
| stringstream.cpp:56:11:56:13 | stringstream.cpp:56:15:56:29 | AST only |
| stringstream.cpp:57:44:57:46 | stringstream.cpp:57:25:57:39 | AST only |
@@ -278,6 +154,7 @@
| stringstream.cpp:67:7:67:10 | stringstream.cpp:64:36:64:41 | AST only |
| stringstream.cpp:76:11:76:11 | stringstream.cpp:70:32:70:37 | AST only |
| stringstream.cpp:78:11:78:11 | stringstream.cpp:70:32:70:37 | AST only |
| stringstream.cpp:83:7:83:15 | stringstream.cpp:70:32:70:37 | IR only |
| stringstream.cpp:100:11:100:11 | stringstream.cpp:100:31:100:36 | AST only |
| stringstream.cpp:143:11:143:22 | stringstream.cpp:143:14:143:19 | IR only |
| stringstream.cpp:146:11:146:11 | stringstream.cpp:143:14:143:19 | AST only |
@@ -307,13 +184,13 @@
| stringstream.cpp:266:62:266:66 | stringstream.cpp:266:41:266:46 | AST only |
| stringstream.cpp:267:7:267:9 | stringstream.cpp:266:41:266:46 | AST only |
| swap1.cpp:78:12:78:16 | swap1.cpp:69:23:69:23 | AST only |
| swap1.cpp:87:13:87:17 | swap1.cpp:82:16:82:21 | AST only |
| swap1.cpp:88:13:88:17 | swap1.cpp:81:27:81:28 | AST only |
| swap1.cpp:102:12:102:16 | swap1.cpp:93:23:93:23 | AST only |
| swap1.cpp:115:18:115:22 | swap1.cpp:108:23:108:31 | AST only |
| swap1.cpp:129:12:129:16 | swap1.cpp:120:23:120:23 | AST only |
| swap1.cpp:144:12:144:16 | swap1.cpp:135:23:135:23 | AST only |
| swap2.cpp:78:12:78:16 | swap2.cpp:69:23:69:23 | AST only |
| swap2.cpp:87:13:87:17 | swap2.cpp:82:16:82:21 | IR only |
| swap2.cpp:88:13:88:17 | swap2.cpp:81:27:81:28 | AST only |
| swap2.cpp:102:12:102:16 | swap2.cpp:93:23:93:23 | AST only |
| swap2.cpp:115:18:115:22 | swap2.cpp:108:23:108:31 | AST only |
@@ -358,7 +235,6 @@
| vector.cpp:171:13:171:13 | vector.cpp:170:14:170:19 | AST only |
| vector.cpp:180:13:180:13 | vector.cpp:179:14:179:19 | AST only |
| vector.cpp:201:13:201:13 | vector.cpp:200:14:200:19 | AST only |
| vector.cpp:261:8:261:9 | vector.cpp:239:15:239:20 | AST only |
| vector.cpp:286:10:286:13 | vector.cpp:284:15:284:20 | AST only |
| vector.cpp:287:7:287:18 | vector.cpp:284:15:284:20 | AST only |
| vector.cpp:290:7:290:8 | vector.cpp:289:17:289:30 | AST only |
@@ -390,3 +266,5 @@
| vector.cpp:450:8:450:10 | vector.cpp:449:11:449:16 | AST only |
| vector.cpp:473:8:473:8 | vector.cpp:468:11:468:16 | AST only |
| vector.cpp:486:8:486:9 | vector.cpp:478:21:478:37 | AST only |
| vector.cpp:494:7:494:8 | vector.cpp:493:18:493:23 | AST only |
| vector.cpp:497:7:497:8 | vector.cpp:496:25:496:30 | AST only |

159
cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
View File

@@ -26,6 +26,7 @@
| copyableclass.cpp:67:11:67:21 | (reference dereference) | copyableclass.cpp:67:13:67:18 | call to source |
| copyableclass_declonly.cpp:40:8:40:9 | s1 | copyableclass_declonly.cpp:34:30:34:35 | call to source |
| copyableclass_declonly.cpp:41:8:41:9 | s2 | copyableclass_declonly.cpp:35:32:35:37 | call to source |
| copyableclass_declonly.cpp:42:8:42:9 | s3 | copyableclass_declonly.cpp:34:30:34:35 | call to source |
| copyableclass_declonly.cpp:43:8:43:9 | s4 | copyableclass_declonly.cpp:38:8:38:13 | call to source |
| copyableclass_declonly.cpp:65:8:65:9 | s1 | copyableclass_declonly.cpp:60:56:60:61 | call to source |
| copyableclass_declonly.cpp:66:8:66:9 | s2 | copyableclass_declonly.cpp:63:32:63:37 | call to source |
@@ -66,6 +67,7 @@
| map.cpp:79:9:79:13 | first | map.cpp:66:37:66:42 | call to source |
| map.cpp:80:9:80:14 | second | map.cpp:66:37:66:42 | call to source |
| map.cpp:81:7:81:7 | l | map.cpp:66:37:66:42 | call to source |
| map.cpp:87:34:87:38 | first | map.cpp:87:17:87:22 | call to source |
| map.cpp:89:7:89:32 | call to pair | map.cpp:89:24:89:29 | call to source |
| map.cpp:90:34:90:38 | first | map.cpp:90:24:90:29 | call to source |
| map.cpp:91:34:91:39 | second | map.cpp:91:24:91:29 | call to source |
@@ -73,10 +75,23 @@
| map.cpp:110:10:110:15 | call to insert | map.cpp:110:62:110:67 | call to source |
| map.cpp:111:7:111:48 | call to iterator | map.cpp:111:34:111:39 | call to source |
| map.cpp:112:10:112:25 | call to insert_or_assign | map.cpp:112:46:112:51 | call to source |
| map.cpp:114:7:114:8 | call to map | map.cpp:108:39:108:44 | call to source |
| map.cpp:116:7:116:8 | call to map | map.cpp:110:62:110:67 | call to source |
| map.cpp:117:7:117:8 | call to map | map.cpp:111:34:111:39 | call to source |
| map.cpp:118:7:118:8 | call to map | map.cpp:112:46:112:51 | call to source |
| map.cpp:120:10:120:13 | call to find | map.cpp:108:39:108:44 | call to source |
| map.cpp:122:10:122:13 | call to find | map.cpp:110:62:110:67 | call to source |
| map.cpp:123:10:123:13 | call to find | map.cpp:111:34:111:39 | call to source |
| map.cpp:124:10:124:13 | call to find | map.cpp:112:46:112:51 | call to source |
| map.cpp:126:10:126:13 | call to find | map.cpp:108:39:108:44 | call to source |
| map.cpp:128:10:128:13 | call to find | map.cpp:110:62:110:67 | call to source |
| map.cpp:129:10:129:13 | call to find | map.cpp:111:34:111:39 | call to source |
| map.cpp:130:10:130:13 | call to find | map.cpp:112:46:112:51 | call to source |
| map.cpp:137:7:137:8 | call to map | map.cpp:108:39:108:44 | call to source |
| map.cpp:138:7:138:8 | call to map | map.cpp:108:39:108:44 | call to source |
| map.cpp:139:7:139:8 | call to map | map.cpp:108:39:108:44 | call to source |
| map.cpp:140:10:140:13 | call to find | map.cpp:108:39:108:44 | call to source |
| map.cpp:141:10:141:13 | call to find | map.cpp:108:39:108:44 | call to source |
| map.cpp:142:10:142:13 | call to find | map.cpp:108:39:108:44 | call to source |
| map.cpp:154:8:154:10 | call to pair | map.cpp:108:39:108:44 | call to source |
| map.cpp:155:12:155:16 | first | map.cpp:108:39:108:44 | call to source |
@@ -91,20 +106,54 @@
| map.cpp:185:7:185:32 | call to iterator | map.cpp:108:39:108:44 | call to source |
| map.cpp:186:10:186:20 | call to upper_bound | map.cpp:108:39:108:44 | call to source |
| map.cpp:187:7:187:32 | call to iterator | map.cpp:108:39:108:44 | call to source |
| map.cpp:193:7:193:9 | call to map | map.cpp:191:49:191:54 | call to source |
| map.cpp:196:7:196:9 | call to map | map.cpp:192:49:192:54 | call to source |
| map.cpp:199:7:199:9 | call to map | map.cpp:191:49:191:54 | call to source |
| map.cpp:200:7:200:9 | call to map | map.cpp:191:49:191:54 | call to source |
| map.cpp:201:7:201:9 | call to map | map.cpp:192:49:192:54 | call to source |
| map.cpp:202:7:202:9 | call to map | map.cpp:192:49:192:54 | call to source |
| map.cpp:210:7:210:9 | call to map | map.cpp:206:49:206:54 | call to source |
| map.cpp:213:7:213:9 | call to map | map.cpp:209:49:209:54 | call to source |
| map.cpp:216:7:216:9 | call to map | map.cpp:206:49:206:54 | call to source |
| map.cpp:218:7:218:9 | call to map | map.cpp:209:49:209:54 | call to source |
| map.cpp:219:7:219:9 | call to map | map.cpp:209:49:209:54 | call to source |
| map.cpp:225:7:225:9 | call to map | map.cpp:223:49:223:54 | call to source |
| map.cpp:225:7:225:9 | call to map | map.cpp:224:49:224:54 | call to source |
| map.cpp:226:11:226:15 | call to erase | map.cpp:223:49:223:54 | call to source |
| map.cpp:226:11:226:15 | call to erase | map.cpp:224:49:224:54 | call to source |
| map.cpp:227:7:227:9 | call to map | map.cpp:223:49:223:54 | call to source |
| map.cpp:227:7:227:9 | call to map | map.cpp:224:49:224:54 | call to source |
| map.cpp:229:7:229:9 | call to map | map.cpp:223:49:223:54 | call to source |
| map.cpp:229:7:229:9 | call to map | map.cpp:224:49:224:54 | call to source |
| map.cpp:235:7:235:40 | call to iterator | map.cpp:235:26:235:31 | call to source |
| map.cpp:236:7:236:9 | call to map | map.cpp:235:26:235:31 | call to source |
| map.cpp:239:11:239:22 | call to emplace_hint | map.cpp:239:44:239:49 | call to source |
| map.cpp:240:7:240:9 | call to map | map.cpp:239:44:239:49 | call to source |
| map.cpp:246:7:246:44 | call to iterator | map.cpp:246:30:246:35 | call to source |
| map.cpp:247:7:247:9 | call to map | map.cpp:246:30:246:35 | call to source |
| map.cpp:250:11:250:21 | call to try_emplace | map.cpp:250:43:250:48 | call to source |
| map.cpp:251:7:251:9 | call to map | map.cpp:250:43:250:48 | call to source |
| map.cpp:260:7:260:54 | call to iterator | map.cpp:260:39:260:44 | call to source |
| map.cpp:262:10:262:15 | call to insert | map.cpp:262:62:262:67 | call to source |
| map.cpp:263:7:263:48 | call to iterator | map.cpp:263:34:263:39 | call to source |
| map.cpp:264:10:264:25 | call to insert_or_assign | map.cpp:264:46:264:51 | call to source |
| map.cpp:266:7:266:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
| map.cpp:268:7:268:8 | call to unordered_map | map.cpp:262:62:262:67 | call to source |
| map.cpp:269:7:269:8 | call to unordered_map | map.cpp:263:34:263:39 | call to source |
| map.cpp:270:7:270:8 | call to unordered_map | map.cpp:264:46:264:51 | call to source |
| map.cpp:272:10:272:13 | call to find | map.cpp:260:39:260:44 | call to source |
| map.cpp:274:10:274:13 | call to find | map.cpp:262:62:262:67 | call to source |
| map.cpp:275:10:275:13 | call to find | map.cpp:263:34:263:39 | call to source |
| map.cpp:276:10:276:13 | call to find | map.cpp:264:46:264:51 | call to source |
| map.cpp:278:10:278:13 | call to find | map.cpp:260:39:260:44 | call to source |
| map.cpp:280:10:280:13 | call to find | map.cpp:262:62:262:67 | call to source |
| map.cpp:281:10:281:13 | call to find | map.cpp:263:34:263:39 | call to source |
| map.cpp:282:10:282:13 | call to find | map.cpp:264:46:264:51 | call to source |
| map.cpp:289:7:289:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
| map.cpp:290:7:290:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
| map.cpp:291:7:291:8 | call to unordered_map | map.cpp:260:39:260:44 | call to source |
| map.cpp:292:10:292:13 | call to find | map.cpp:260:39:260:44 | call to source |
| map.cpp:293:10:293:13 | call to find | map.cpp:260:39:260:44 | call to source |
| map.cpp:294:10:294:13 | call to find | map.cpp:260:39:260:44 | call to source |
| map.cpp:306:8:306:10 | call to pair | map.cpp:260:39:260:44 | call to source |
| map.cpp:307:12:307:16 | first | map.cpp:260:39:260:44 | call to source |
@@ -116,16 +165,42 @@
| map.cpp:334:7:334:31 | call to iterator | map.cpp:260:39:260:44 | call to source |
| map.cpp:335:7:335:32 | call to iterator | map.cpp:260:39:260:44 | call to source |
| map.cpp:336:7:336:32 | call to iterator | map.cpp:260:39:260:44 | call to source |
| map.cpp:342:7:342:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
| map.cpp:345:7:345:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
| map.cpp:348:7:348:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
| map.cpp:349:7:349:9 | call to unordered_map | map.cpp:340:49:340:54 | call to source |
| map.cpp:350:7:350:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
| map.cpp:351:7:351:9 | call to unordered_map | map.cpp:341:49:341:54 | call to source |
| map.cpp:359:7:359:9 | call to unordered_map | map.cpp:355:49:355:54 | call to source |
| map.cpp:362:7:362:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
| map.cpp:365:7:365:9 | call to unordered_map | map.cpp:355:49:355:54 | call to source |
| map.cpp:367:7:367:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
| map.cpp:368:7:368:9 | call to unordered_map | map.cpp:358:49:358:54 | call to source |
| map.cpp:374:7:374:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
| map.cpp:374:7:374:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
| map.cpp:375:11:375:15 | call to erase | map.cpp:372:49:372:54 | call to source |
| map.cpp:375:11:375:15 | call to erase | map.cpp:373:49:373:54 | call to source |
| map.cpp:376:7:376:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
| map.cpp:376:7:376:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
| map.cpp:378:7:378:9 | call to unordered_map | map.cpp:372:49:372:54 | call to source |
| map.cpp:378:7:378:9 | call to unordered_map | map.cpp:373:49:373:54 | call to source |
| map.cpp:384:7:384:40 | call to iterator | map.cpp:384:26:384:31 | call to source |
| map.cpp:385:7:385:9 | call to unordered_map | map.cpp:384:26:384:31 | call to source |
| map.cpp:388:11:388:22 | call to emplace_hint | map.cpp:388:44:388:49 | call to source |
| map.cpp:389:7:389:9 | call to unordered_map | map.cpp:388:44:388:49 | call to source |
| map.cpp:396:7:396:44 | call to iterator | map.cpp:396:30:396:35 | call to source |
| map.cpp:397:40:397:45 | second | map.cpp:396:30:396:35 | call to source |
| map.cpp:397:40:397:45 | second | map.cpp:397:30:397:35 | call to source |
| map.cpp:398:7:398:9 | call to unordered_map | map.cpp:396:30:396:35 | call to source |
| map.cpp:398:7:398:9 | call to unordered_map | map.cpp:397:30:397:35 | call to source |
| map.cpp:401:11:401:21 | call to try_emplace | map.cpp:401:43:401:48 | call to source |
| map.cpp:402:7:402:9 | call to unordered_map | map.cpp:401:43:401:48 | call to source |
| map.cpp:416:7:416:41 | call to pair | map.cpp:416:30:416:35 | call to source |
| map.cpp:417:7:417:9 | call to unordered_map | map.cpp:416:30:416:35 | call to source |
| map.cpp:419:7:419:41 | call to pair | map.cpp:419:33:419:38 | call to source |
| map.cpp:420:7:420:9 | call to unordered_map | map.cpp:419:33:419:38 | call to source |
| map.cpp:431:7:431:67 | call to iterator | map.cpp:431:52:431:57 | call to source |
| map.cpp:432:7:432:9 | call to unordered_map | map.cpp:431:52:431:57 | call to source |
| map.cpp:433:11:433:22 | call to emplace_hint | map.cpp:431:52:431:57 | call to source |
| movableclass.cpp:44:8:44:9 | s1 | movableclass.cpp:39:21:39:26 | call to source |
| movableclass.cpp:45:8:45:9 | s2 | movableclass.cpp:40:23:40:28 | call to source |
@@ -136,9 +211,18 @@
| movableclass.cpp:65:11:65:21 | (reference dereference) | movableclass.cpp:65:13:65:18 | call to source |
| set.cpp:20:7:20:31 | call to iterator | set.cpp:20:17:20:22 | call to source |
| set.cpp:22:10:22:15 | call to insert | set.cpp:22:29:22:34 | call to source |
| set.cpp:26:7:26:8 | call to set | set.cpp:20:17:20:22 | call to source |
| set.cpp:28:7:28:8 | call to set | set.cpp:22:29:22:34 | call to source |
| set.cpp:30:7:30:8 | call to set | set.cpp:20:17:20:22 | call to source |
| set.cpp:32:10:32:13 | call to find | set.cpp:20:17:20:22 | call to source |
| set.cpp:34:10:34:13 | call to find | set.cpp:22:29:22:34 | call to source |
| set.cpp:36:10:36:13 | call to find | set.cpp:20:17:20:22 | call to source |
| set.cpp:44:7:44:8 | call to set | set.cpp:20:17:20:22 | call to source |
| set.cpp:45:7:45:8 | call to set | set.cpp:20:17:20:22 | call to source |
| set.cpp:46:7:46:8 | call to set | set.cpp:20:17:20:22 | call to source |
| set.cpp:47:7:47:9 | call to set | set.cpp:20:17:20:22 | call to source |
| set.cpp:48:10:48:13 | call to find | set.cpp:20:17:20:22 | call to source |
| set.cpp:49:10:49:13 | call to find | set.cpp:20:17:20:22 | call to source |
| set.cpp:50:10:50:13 | call to find | set.cpp:20:17:20:22 | call to source |
| set.cpp:51:11:51:14 | call to find | set.cpp:20:17:20:22 | call to source |
| set.cpp:61:8:61:8 | call to operator* | set.cpp:20:17:20:22 | call to source |
@@ -147,25 +231,72 @@
| set.cpp:70:11:70:21 | call to upper_bound | set.cpp:67:13:67:18 | call to source |
| set.cpp:71:7:71:32 | call to iterator | set.cpp:67:13:67:18 | call to source |
| set.cpp:72:7:72:33 | call to iterator | set.cpp:67:13:67:18 | call to source |
| set.cpp:78:7:78:9 | call to set | set.cpp:76:13:76:18 | call to source |
| set.cpp:81:7:81:9 | call to set | set.cpp:77:13:77:18 | call to source |
| set.cpp:84:7:84:9 | call to set | set.cpp:76:13:76:18 | call to source |
| set.cpp:85:7:85:9 | call to set | set.cpp:76:13:76:18 | call to source |
| set.cpp:86:7:86:9 | call to set | set.cpp:77:13:77:18 | call to source |
| set.cpp:87:7:87:9 | call to set | set.cpp:77:13:77:18 | call to source |
| set.cpp:95:7:95:9 | call to set | set.cpp:91:13:91:18 | call to source |
| set.cpp:98:7:98:9 | call to set | set.cpp:94:13:94:18 | call to source |
| set.cpp:101:7:101:9 | call to set | set.cpp:91:13:91:18 | call to source |
| set.cpp:103:7:103:9 | call to set | set.cpp:94:13:94:18 | call to source |
| set.cpp:104:7:104:9 | call to set | set.cpp:94:13:94:18 | call to source |
| set.cpp:110:7:110:9 | call to set | set.cpp:108:13:108:18 | call to source |
| set.cpp:110:7:110:9 | call to set | set.cpp:109:13:109:18 | call to source |
| set.cpp:111:11:111:15 | call to erase | set.cpp:108:13:108:18 | call to source |
| set.cpp:111:11:111:15 | call to erase | set.cpp:109:13:109:18 | call to source |
| set.cpp:112:7:112:9 | call to set | set.cpp:108:13:108:18 | call to source |
| set.cpp:112:7:112:9 | call to set | set.cpp:109:13:109:18 | call to source |
| set.cpp:114:7:114:9 | call to set | set.cpp:108:13:108:18 | call to source |
| set.cpp:114:7:114:9 | call to set | set.cpp:109:13:109:18 | call to source |
| set.cpp:120:7:120:33 | call to iterator | set.cpp:120:19:120:24 | call to source |
| set.cpp:121:7:121:9 | call to set | set.cpp:120:19:120:24 | call to source |
| set.cpp:124:11:124:22 | call to emplace_hint | set.cpp:124:37:124:42 | call to source |
| set.cpp:125:7:125:9 | call to set | set.cpp:124:37:124:42 | call to source |
| set.cpp:134:7:134:31 | call to iterator | set.cpp:134:17:134:22 | call to source |
| set.cpp:136:10:136:15 | call to insert | set.cpp:136:29:136:34 | call to source |
| set.cpp:140:7:140:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
| set.cpp:142:7:142:8 | call to unordered_set | set.cpp:136:29:136:34 | call to source |
| set.cpp:144:7:144:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
| set.cpp:146:10:146:13 | call to find | set.cpp:134:17:134:22 | call to source |
| set.cpp:148:10:148:13 | call to find | set.cpp:136:29:136:34 | call to source |
| set.cpp:150:10:150:13 | call to find | set.cpp:134:17:134:22 | call to source |
| set.cpp:158:7:158:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
| set.cpp:159:7:159:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
| set.cpp:160:7:160:8 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
| set.cpp:161:7:161:9 | call to unordered_set | set.cpp:134:17:134:22 | call to source |
| set.cpp:162:10:162:13 | call to find | set.cpp:134:17:134:22 | call to source |
| set.cpp:163:10:163:13 | call to find | set.cpp:134:17:134:22 | call to source |
| set.cpp:164:10:164:13 | call to find | set.cpp:134:17:134:22 | call to source |
| set.cpp:165:11:165:14 | call to find | set.cpp:134:17:134:22 | call to source |
| set.cpp:175:8:175:8 | call to operator* | set.cpp:134:17:134:22 | call to source |
| set.cpp:175:8:175:11 | (reference dereference) | set.cpp:134:17:134:22 | call to source |
| set.cpp:183:7:183:32 | call to iterator | set.cpp:181:13:181:18 | call to source |
| set.cpp:184:7:184:33 | call to iterator | set.cpp:181:13:181:18 | call to source |
| set.cpp:190:7:190:9 | call to unordered_set | set.cpp:188:13:188:18 | call to source |
| set.cpp:193:7:193:9 | call to unordered_set | set.cpp:189:13:189:18 | call to source |
| set.cpp:196:7:196:9 | call to unordered_set | set.cpp:188:13:188:18 | call to source |
| set.cpp:197:7:197:9 | call to unordered_set | set.cpp:188:13:188:18 | call to source |
| set.cpp:198:7:198:9 | call to unordered_set | set.cpp:189:13:189:18 | call to source |
| set.cpp:199:7:199:9 | call to unordered_set | set.cpp:189:13:189:18 | call to source |
| set.cpp:207:7:207:9 | call to unordered_set | set.cpp:203:13:203:18 | call to source |
| set.cpp:210:7:210:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
| set.cpp:213:7:213:9 | call to unordered_set | set.cpp:203:13:203:18 | call to source |
| set.cpp:215:7:215:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
| set.cpp:216:7:216:9 | call to unordered_set | set.cpp:206:13:206:18 | call to source |
| set.cpp:222:7:222:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
| set.cpp:222:7:222:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
| set.cpp:223:11:223:15 | call to erase | set.cpp:220:13:220:18 | call to source |
| set.cpp:223:11:223:15 | call to erase | set.cpp:221:13:221:18 | call to source |
| set.cpp:224:7:224:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
| set.cpp:224:7:224:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
| set.cpp:226:7:226:9 | call to unordered_set | set.cpp:220:13:220:18 | call to source |
| set.cpp:226:7:226:9 | call to unordered_set | set.cpp:221:13:221:18 | call to source |
| set.cpp:232:7:232:33 | call to iterator | set.cpp:232:19:232:24 | call to source |
| set.cpp:233:7:233:9 | call to unordered_set | set.cpp:232:19:232:24 | call to source |
| set.cpp:236:11:236:22 | call to emplace_hint | set.cpp:236:37:236:42 | call to source |
| set.cpp:237:7:237:9 | call to unordered_set | set.cpp:236:37:236:42 | call to source |
| smart_pointer.cpp:13:10:13:10 | Argument 0 indirection | smart_pointer.cpp:11:52:11:57 | call to source |
| smart_pointer.cpp:25:10:25:10 | Argument 0 indirection | smart_pointer.cpp:23:52:23:57 | call to source |
| smart_pointer.cpp:52:12:52:14 | call to get | smart_pointer.cpp:51:52:51:57 | call to source |
@@ -189,9 +320,13 @@
| string.cpp:130:8:130:8 | c | string.cpp:120:16:120:21 | call to source |
| string.cpp:135:8:135:8 | (reference dereference) | string.cpp:133:28:133:33 | call to source |
| string.cpp:135:8:135:8 | c | string.cpp:133:28:133:33 | call to source |
| string.cpp:145:8:145:14 | Argument 0 indirection | string.cpp:142:18:142:23 | call to source |
| string.cpp:145:11:145:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
| string.cpp:146:8:146:14 | Argument 0 indirection | string.cpp:142:18:142:23 | call to source |
| string.cpp:146:11:146:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
| string.cpp:147:8:147:14 | Argument 0 indirection | string.cpp:142:18:142:23 | call to source |
| string.cpp:147:11:147:11 | call to operator+ | string.cpp:142:18:142:23 | call to source |
| string.cpp:150:8:150:20 | Argument 0 indirection | string.cpp:150:13:150:18 | call to source |
| string.cpp:150:11:150:11 | call to operator+ | string.cpp:150:13:150:18 | call to source |
| string.cpp:159:8:159:9 | Argument 0 indirection | string.cpp:155:18:155:23 | call to source |
| string.cpp:163:8:163:9 | Argument 0 indirection | string.cpp:155:18:155:23 | call to source |
@@ -220,18 +355,25 @@
| string.cpp:295:7:295:8 | Argument 0 indirection | string.cpp:291:17:291:22 | call to source |
| string.cpp:301:7:301:8 | Argument 0 indirection | string.cpp:289:17:289:22 | call to source |
| string.cpp:303:7:303:8 | Argument 0 indirection | string.cpp:291:17:291:22 | call to source |
| string.cpp:323:7:323:29 | Argument 0 indirection | string.cpp:320:16:320:21 | call to source |
| string.cpp:323:9:323:14 | call to substr | string.cpp:320:16:320:21 | call to source |
| string.cpp:364:8:364:9 | Argument 0 indirection | string.cpp:358:18:358:23 | call to source |
| string.cpp:382:8:382:8 | call to operator* | string.cpp:374:18:374:23 | call to source |
| string.cpp:382:8:382:14 | (reference dereference) | string.cpp:374:18:374:23 | call to source |
| string.cpp:383:13:383:13 | call to operator[] | string.cpp:374:18:374:23 | call to source |
| string.cpp:383:13:383:15 | (reference dereference) | string.cpp:374:18:374:23 | call to source |
| string.cpp:396:8:396:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
| string.cpp:396:8:396:15 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
| string.cpp:397:8:397:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
| string.cpp:397:8:397:15 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
| string.cpp:404:8:404:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
| string.cpp:404:8:404:11 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
| string.cpp:407:8:407:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
| string.cpp:407:8:407:11 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
| string.cpp:415:8:415:8 | call to operator* | string.cpp:389:18:389:23 | call to source |
| string.cpp:415:8:415:11 | (reference dereference) | string.cpp:389:18:389:23 | call to source |
| string.cpp:419:8:419:10 | call to iterator | string.cpp:389:18:389:23 | call to source |
| string.cpp:422:8:422:10 | call to iterator | string.cpp:389:18:389:23 | call to source |
| string.cpp:437:7:437:8 | Argument 0 indirection | string.cpp:431:14:431:19 | call to source |
| string.cpp:450:8:450:8 | Argument 0 indirection | string.cpp:449:32:449:46 | call to source |
| string.cpp:463:8:463:8 | Argument 0 indirection | string.cpp:457:18:457:23 | call to source |
@@ -254,13 +396,16 @@
| stringstream.cpp:34:23:34:31 | (reference dereference) | stringstream.cpp:34:14:34:19 | call to source |
| stringstream.cpp:38:7:38:9 | Argument 0 indirection | stringstream.cpp:32:14:32:19 | call to source |
| stringstream.cpp:40:7:40:9 | Argument 0 indirection | stringstream.cpp:34:14:34:19 | call to source |
| stringstream.cpp:43:7:43:15 | Argument 0 indirection | stringstream.cpp:32:14:32:19 | call to source |
| stringstream.cpp:43:11:43:13 | call to str | stringstream.cpp:32:14:32:19 | call to source |
| stringstream.cpp:45:7:45:15 | Argument 0 indirection | stringstream.cpp:34:14:34:19 | call to source |
| stringstream.cpp:45:11:45:13 | call to str | stringstream.cpp:34:14:34:19 | call to source |
| stringstream.cpp:52:7:52:9 | Argument 0 indirection | stringstream.cpp:49:10:49:15 | call to source |
| stringstream.cpp:53:7:53:9 | Argument 0 indirection | stringstream.cpp:50:10:50:15 | call to source |
| stringstream.cpp:59:7:59:9 | Argument 0 indirection | stringstream.cpp:56:15:56:29 | call to source |
| stringstream.cpp:66:7:66:10 | Argument 0 indirection | stringstream.cpp:63:18:63:23 | call to source |
| stringstream.cpp:81:7:81:9 | Argument 0 indirection | stringstream.cpp:70:32:70:37 | source |
| stringstream.cpp:83:7:83:15 | Argument 0 indirection | stringstream.cpp:70:32:70:37 | source |
| stringstream.cpp:83:11:83:13 | call to str | stringstream.cpp:70:32:70:37 | source |
| stringstream.cpp:85:7:85:8 | v2 | stringstream.cpp:70:32:70:37 | source |
| stringstream.cpp:103:7:103:9 | Argument 0 indirection | stringstream.cpp:91:19:91:24 | call to source |
@@ -274,10 +419,15 @@
| stringstream.cpp:143:11:143:22 | (reference dereference) | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:149:7:149:8 | Argument 0 indirection | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:150:7:150:8 | Argument 0 indirection | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:157:7:157:8 | Argument 0 indirection | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:157:7:157:8 | call to basic_string | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:158:7:158:8 | Argument 0 indirection | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:158:7:158:8 | call to basic_string | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:168:7:168:8 | Argument 0 indirection | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:168:7:168:8 | call to basic_string | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:170:7:170:8 | Argument 0 indirection | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:170:7:170:8 | call to basic_string | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:172:7:172:9 | Argument 0 indirection | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:172:7:172:9 | call to basic_string | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:175:7:175:20 | ... = ... | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:177:7:177:21 | ... = ... | stringstream.cpp:143:14:143:19 | call to source |
@@ -285,16 +435,22 @@
| stringstream.cpp:183:7:183:8 | c4 | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:185:7:185:8 | c6 | stringstream.cpp:143:14:143:19 | call to source |
| stringstream.cpp:197:10:197:12 | call to get | stringstream.cpp:196:18:196:32 | call to source |
| stringstream.cpp:219:7:219:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:219:7:219:8 | call to basic_string | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:220:7:220:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:220:7:220:8 | call to basic_string | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:227:7:227:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:227:7:227:8 | call to basic_string | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:228:7:228:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:228:7:228:8 | call to basic_string | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:231:7:231:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:231:7:231:8 | call to basic_string | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:239:7:239:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:240:7:240:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:247:7:247:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:248:7:248:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:251:7:251:8 | Argument 0 indirection | stringstream.cpp:203:24:203:29 | call to source |
| stringstream.cpp:263:7:263:8 | Argument 0 indirection | stringstream.cpp:257:24:257:29 | call to source |
| stringstream.cpp:263:7:263:8 | call to basic_string | stringstream.cpp:257:24:257:29 | call to source |
| structlikeclass.cpp:35:8:35:9 | s1 | structlikeclass.cpp:29:22:29:27 | call to source |
| structlikeclass.cpp:36:8:36:9 | s2 | structlikeclass.cpp:30:24:30:29 | call to source |
@@ -307,6 +463,7 @@
| swap1.cpp:78:12:78:16 | data1 | swap1.cpp:71:15:71:20 | call to source |
| swap1.cpp:79:12:79:16 | data1 | swap1.cpp:71:15:71:20 | call to source |
| swap1.cpp:83:13:83:17 | data1 | swap1.cpp:82:16:82:21 | call to source |
| swap1.cpp:87:13:87:17 | data1 | swap1.cpp:82:16:82:21 | call to source |
| swap1.cpp:88:13:88:17 | data1 | swap1.cpp:82:16:82:21 | call to source |
| swap1.cpp:97:12:97:16 | data1 | swap1.cpp:95:15:95:20 | call to source |
| swap1.cpp:102:12:102:16 | data1 | swap1.cpp:95:15:95:20 | call to source |
@@ -323,6 +480,7 @@
| swap2.cpp:78:12:78:16 | data1 | swap2.cpp:71:15:71:20 | call to source |
| swap2.cpp:79:12:79:16 | data1 | swap2.cpp:71:15:71:20 | call to source |
| swap2.cpp:83:13:83:17 | data1 | swap2.cpp:82:16:82:21 | call to source |
| swap2.cpp:87:13:87:17 | data1 | swap2.cpp:82:16:82:21 | call to source |
| swap2.cpp:88:13:88:17 | data1 | swap2.cpp:82:16:82:21 | call to source |
| swap2.cpp:97:12:97:16 | data1 | swap2.cpp:95:15:95:20 | call to source |
| swap2.cpp:102:12:102:16 | data1 | swap2.cpp:95:15:95:20 | call to source |
@@ -408,6 +566,7 @@
| vector.cpp:258:8:258:9 | Argument 0 indirection | vector.cpp:239:15:239:20 | call to source |
| vector.cpp:259:8:259:9 | Argument 0 indirection | vector.cpp:239:15:239:20 | call to source |
| vector.cpp:260:8:260:9 | Argument 0 indirection | vector.cpp:239:15:239:20 | call to source |
| vector.cpp:261:8:261:9 | Argument 0 indirection | vector.cpp:239:15:239:20 | call to source |
| vector.cpp:273:8:273:9 | Argument 0 indirection | vector.cpp:269:18:269:31 | call to source |
| vector.cpp:274:8:274:9 | Argument 0 indirection | vector.cpp:270:18:270:35 | call to source |
| vector.cpp:275:8:275:9 | Argument 0 indirection | vector.cpp:271:18:271:34 | call to source |

35
cpp/ql/test/library-tests/dataflow/taint-tests/type_traits.h Normal file
View File

@@ -0,0 +1,35 @@
template<class T>
struct remove_const { typedef T type; };
template<class T>
struct remove_const<const T> { typedef T type; };
// `remove_const_t<T>` removes any `const` specifier from `T`
template<class T>
using remove_const_t = typename remove_const<T>::type;
template<class T>
struct remove_reference { typedef T type; };
template<class T>
struct remove_reference<T &> { typedef T type; };
template<class T>
struct remove_reference<T &&> { typedef T type; };
// `remove_reference_t<T>` removes any `&` from `T`
template<class T>
using remove_reference_t = typename remove_reference<T>::type;
template<class T>
struct decay_impl {
typedef T type;
};
template<class T, size_t t_size>
struct decay_impl<T[t_size]> {
typedef T* type;
};
template<class T>
using decay_t = typename decay_impl<remove_reference_t<T>>::type;

12
cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
View File

@@ -312,7 +312,7 @@ void test_vector_insert() {
sink(d); // tainted
}
void test_constructors_more() {
void test_vector_constructors_more() {
std::vector<int> v1;
std::vector<int> v2;
v2.push_back(source());
@@ -486,3 +486,13 @@ void test_vector_memcpy()
sink(cs); // tainted [NOT DETECTED by IR]
}
}
void test_vector_emplace() {
std::vector<int> v1(10), v2(10);
v1.emplace_back(source());
sink(v1); // tainted
v2.emplace(v2.begin(), source());
sink(v2); // tainted
}