hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: add tests for back_inserter iterator flow

Browse Source
This commit is contained in:
Robert Marsh
2020-10-07 12:41:09 -07:00
parent 108cc9ea47
commit 45a27d3296
5 changed files with 270 additions and 142 deletions
Download Patch File Download Diff File Expand all files Collapse all files

334
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -260,6 +260,8 @@
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
| format.cpp:16:21:16:21 | s | format.cpp:22:22:22:22 | s | |
| format.cpp:16:31:16:31 | n | format.cpp:22:25:22:25 | n | |
| format.cpp:16:46:16:51 | format | format.cpp:22:28:22:33 | format | |
@@ -3145,147 +3147,160 @@
| standalone_iterators.cpp:51:37:51:43 | source1 | standalone_iterators.cpp:53:12:53:18 | source1 | |
| standalone_iterators.cpp:51:37:51:43 | source1 | standalone_iterators.cpp:54:14:54:20 | source1 | |
| standalone_iterators.cpp:53:12:53:18 | ref arg source1 | standalone_iterators.cpp:54:14:54:20 | source1 | |
| stl.h:241:30:241:40 | call to allocator | stl.h:241:21:241:41 | noexcept(...) | TAINT |
| stl.h:241:30:241:40 | call to allocator | stl.h:241:21:241:41 | noexcept(...) | TAINT |
| stl.h:241:30:241:40 | call to allocator | stl.h:241:21:241:41 | noexcept(...) | TAINT |
| stl.h:241:30:241:40 | call to allocator | stl.h:241:21:241:41 | noexcept(...) | TAINT |
| stl.h:241:30:241:40 | call to allocator | stl.h:241:21:241:41 | noexcept(...) | TAINT |
| stl.h:241:53:241:63 | 0 | stl.h:241:46:241:64 | (no string representation) | TAINT |
| stl.h:334:9:334:9 | Unknown literal | stl.h:334:9:334:9 | constructor init of field first | TAINT |
| stl.h:334:9:334:9 | Unknown literal | stl.h:334:9:334:9 | constructor init of field second | TAINT |
| stl.h:334:9:334:9 | constructor init of field first [post-this] | stl.h:334:9:334:9 | constructor init of field second [pre-this] | |
| stl.h:334:9:334:9 | constructor init of field first [pre-this] | stl.h:334:9:334:9 | constructor init of field second [pre-this] | |
| stl.h:334:9:334:9 | this | stl.h:334:9:334:9 | constructor init of field first [pre-this] | |
| stl.h:341:3:341:3 | this | stl.h:341:36:341:43 | constructor init of field first [pre-this] | |
| stl.h:341:3:341:3 | this | stl.h:341:36:341:43 | constructor init of field first [pre-this] | |
| stl.h:341:3:341:3 | this | stl.h:341:36:341:43 | constructor init of field first [pre-this] | |
| stl.h:341:3:341:3 | this | stl.h:341:36:341:43 | constructor init of field first [pre-this] | |
| stl.h:341:3:341:3 | this | stl.h:341:36:341:43 | constructor init of field first [pre-this] | |
| stl.h:341:3:341:3 | this | stl.h:341:36:341:43 | constructor init of field first [pre-this] | |
| stl.h:341:3:341:3 | this | stl.h:341:36:341:43 | constructor init of field first [pre-this] | |
| stl.h:341:3:341:6 | this | stl.h:341:36:341:43 | constructor init of field first [pre-this] | |
| stl.h:341:18:341:18 | x | stl.h:341:18:341:18 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:18:341:18 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:18:341:18 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:18:341:18 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:42:341:42 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:42:341:42 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:42:341:42 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:42:341:42 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:42:341:42 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:42:341:42 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:42:341:42 | x | |
| stl.h:341:18:341:18 | x | stl.h:341:42:341:42 | x | |
| stl.h:341:31:341:31 | y | stl.h:341:31:341:31 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:31:341:31 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:31:341:31 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:31:341:31 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:53:341:53 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:53:341:53 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:53:341:53 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:53:341:53 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:53:341:53 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:53:341:53 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:53:341:53 | y | |
| stl.h:341:31:341:31 | y | stl.h:341:53:341:53 | y | |
| stl.h:341:36:341:43 | call to unknown function | stl.h:341:36:341:43 | constructor init of field first | TAINT |
| stl.h:341:36:341:43 | constructor init of field first [post-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [post-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [post-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [post-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [post-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [post-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [post-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [post-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [pre-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [pre-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [pre-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [pre-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [pre-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [pre-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [pre-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:36:341:43 | constructor init of field first [pre-this] | stl.h:341:46:341:54 | constructor init of field second [pre-this] | |
| stl.h:341:42:341:42 | x | stl.h:341:36:341:43 | constructor init of field first | TAINT |
| stl.h:341:42:341:42 | x | stl.h:341:36:341:43 | constructor init of field first | TAINT |
| stl.h:341:42:341:42 | x | stl.h:341:36:341:43 | constructor init of field first | TAINT |
| stl.h:341:42:341:42 | x | stl.h:341:36:341:43 | constructor init of field first | TAINT |
| stl.h:341:42:341:42 | x | stl.h:341:36:341:43 | constructor init of field first | TAINT |
| stl.h:341:42:341:42 | x | stl.h:341:36:341:43 | constructor init of field first | TAINT |
| stl.h:341:42:341:42 | x | stl.h:341:36:341:43 | constructor init of field first | TAINT |
| stl.h:341:46:341:54 | call to unknown function | stl.h:341:46:341:54 | constructor init of field second | TAINT |
| stl.h:341:53:341:53 | y | stl.h:341:46:341:54 | constructor init of field second | TAINT |
| stl.h:341:53:341:53 | y | stl.h:341:46:341:54 | constructor init of field second | TAINT |
| stl.h:341:53:341:53 | y | stl.h:341:46:341:54 | constructor init of field second | TAINT |
| stl.h:341:53:341:53 | y | stl.h:341:46:341:54 | constructor init of field second | TAINT |
| stl.h:341:53:341:53 | y | stl.h:341:46:341:54 | constructor init of field second | TAINT |
| stl.h:341:53:341:53 | y | stl.h:341:46:341:54 | constructor init of field second | TAINT |
| stl.h:341:53:341:53 | y | stl.h:341:46:341:54 | constructor init of field second | TAINT |
| stl.h:347:109:347:109 | x | stl.h:347:109:347:109 | x | |
| stl.h:347:109:347:109 | x | stl.h:347:109:347:109 | x | |
| stl.h:347:109:347:109 | x | stl.h:347:109:347:109 | x | |
| stl.h:347:109:347:109 | x | stl.h:347:109:347:109 | x | |
| stl.h:347:109:347:109 | x | stl.h:347:109:347:109 | x | |
| stl.h:347:109:347:109 | x | stl.h:347:109:347:109 | x | |
| stl.h:347:109:347:109 | x | stl.h:347:109:347:109 | x | |
| stl.h:347:109:347:109 | x | stl.h:348:40:348:40 | x | |
| stl.h:347:109:347:109 | x | stl.h:348:40:348:40 | x | |
| stl.h:347:109:347:109 | x | stl.h:348:40:348:40 | x | |
| stl.h:347:109:347:109 | x | stl.h:348:40:348:40 | x | |
| stl.h:347:109:347:109 | x | stl.h:348:40:348:40 | x | |
| stl.h:347:109:347:109 | x | stl.h:348:40:348:40 | x | |
| stl.h:347:109:347:109 | x | stl.h:348:40:348:40 | x | |
| stl.h:347:117:347:117 | y | stl.h:347:117:347:117 | y | |
| stl.h:347:117:347:117 | y | stl.h:347:117:347:117 | y | |
| stl.h:347:117:347:117 | y | stl.h:347:117:347:117 | y | |
| stl.h:347:117:347:117 | y | stl.h:347:117:347:117 | y | |
| stl.h:347:117:347:117 | y | stl.h:347:117:347:117 | y | |
| stl.h:347:117:347:117 | y | stl.h:347:117:347:117 | y | |
| stl.h:347:117:347:117 | y | stl.h:347:117:347:117 | y | |
| stl.h:347:117:347:117 | y | stl.h:348:61:348:61 | y | |
| stl.h:347:117:347:117 | y | stl.h:348:61:348:61 | y | |
| stl.h:347:117:347:117 | y | stl.h:348:61:348:61 | y | |
| stl.h:347:117:347:117 | y | stl.h:348:61:348:61 | y | |
| stl.h:347:117:347:117 | y | stl.h:348:61:348:61 | y | |
| stl.h:347:117:347:117 | y | stl.h:348:61:348:61 | y | |
| stl.h:347:117:347:117 | y | stl.h:348:61:348:61 | y | |
| stl.h:348:10:348:63 | call to pair | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:10:348:63 | call to pair | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:10:348:63 | call to pair | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:10:348:63 | call to pair | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:10:348:63 | call to pair | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:10:348:63 | call to pair | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:23:348:38 | ref arg call to forward | stl.h:347:109:347:109 | x | |
| stl.h:348:23:348:38 | ref arg call to forward | stl.h:347:109:347:109 | x | |
| stl.h:348:23:348:38 | ref arg call to forward | stl.h:347:109:347:109 | x | |
| stl.h:348:23:348:38 | ref arg call to forward | stl.h:347:109:347:109 | x | |
| stl.h:348:23:348:38 | ref arg call to forward | stl.h:348:40:348:40 | x [inner post update] | |
| stl.h:348:23:348:38 | ref arg call to forward | stl.h:348:40:348:40 | x [inner post update] | |
| stl.h:348:23:348:38 | ref arg call to forward | stl.h:348:40:348:40 | x [inner post update] | |
| stl.h:348:23:348:38 | ref arg call to forward | stl.h:348:40:348:40 | x [inner post update] | |
| stl.h:348:40:348:40 | x | stl.h:348:23:348:38 | call to forward | |
| stl.h:348:40:348:40 | x | stl.h:348:23:348:38 | call to forward | |
| stl.h:348:40:348:40 | x | stl.h:348:23:348:38 | call to forward | |
| stl.h:348:40:348:40 | x | stl.h:348:23:348:38 | call to forward | |
| stl.h:348:40:348:40 | x | stl.h:348:23:348:38 | call to forward | |
| stl.h:348:40:348:40 | x | stl.h:348:23:348:38 | call to forward | |
| stl.h:348:44:348:59 | call to forward | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:44:348:59 | call to forward | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:44:348:59 | ref arg call to forward | stl.h:347:117:347:117 | y | |
| stl.h:348:44:348:59 | ref arg call to forward | stl.h:347:117:347:117 | y | |
| stl.h:348:44:348:59 | ref arg call to forward | stl.h:347:117:347:117 | y | |
| stl.h:348:44:348:59 | ref arg call to forward | stl.h:347:117:347:117 | y | |
| stl.h:348:44:348:59 | ref arg call to forward | stl.h:348:61:348:61 | y [inner post update] | |
| stl.h:348:44:348:59 | ref arg call to forward | stl.h:348:61:348:61 | y [inner post update] | |
| stl.h:348:44:348:59 | ref arg call to forward | stl.h:348:61:348:61 | y [inner post update] | |
| stl.h:348:44:348:59 | ref arg call to forward | stl.h:348:61:348:61 | y [inner post update] | |
| stl.h:348:61:348:61 | y | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:61:348:61 | y | stl.h:348:10:348:63 | call to pair | TAINT |
| stl.h:348:61:348:61 | y | stl.h:348:44:348:59 | call to forward | |
| stl.h:348:61:348:61 | y | stl.h:348:44:348:59 | call to forward | |
| stl.h:348:61:348:61 | y | stl.h:348:44:348:59 | call to forward | |
| stl.h:348:61:348:61 | y | stl.h:348:44:348:59 | call to forward | |
| stl.h:348:61:348:61 | y | stl.h:348:44:348:59 | call to forward | |
| stl.h:348:61:348:61 | y | stl.h:348:44:348:59 | call to forward | |
| stl.h:75:8:75:8 | Unknown literal | stl.h:75:8:75:8 | constructor init of field container | TAINT |
| stl.h:75:8:75:8 | Unknown literal | stl.h:75:8:75:8 | constructor init of field container | TAINT |
| stl.h:75:8:75:8 | this | stl.h:75:8:75:8 | constructor init of field container [pre-this] | |
| stl.h:75:8:75:8 | this | stl.h:75:8:75:8 | constructor init of field container [pre-this] | |
| stl.h:95:69:95:69 | x | stl.h:95:69:95:69 | x | |
| stl.h:95:69:95:69 | x | stl.h:95:69:95:69 | x | |
| stl.h:95:69:95:69 | x | stl.h:95:69:95:69 | x | |
| stl.h:95:69:95:69 | x | stl.h:96:42:96:42 | x | |
| stl.h:95:69:95:69 | x | stl.h:96:42:96:42 | x | |
| stl.h:95:69:95:69 | x | stl.h:96:42:96:42 | x | |
| stl.h:96:42:96:42 | ref arg x | stl.h:95:69:95:69 | x | |
| stl.h:96:42:96:42 | ref arg x | stl.h:95:69:95:69 | x | |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:30:292:40 | call to allocator | stl.h:292:21:292:41 | noexcept(...) | TAINT |
| stl.h:292:53:292:63 | 0 | stl.h:292:46:292:64 | (no string representation) | TAINT |
| stl.h:385:9:385:9 | Unknown literal | stl.h:385:9:385:9 | constructor init of field first | TAINT |
| stl.h:385:9:385:9 | Unknown literal | stl.h:385:9:385:9 | constructor init of field second | TAINT |
| stl.h:385:9:385:9 | constructor init of field first [post-this] | stl.h:385:9:385:9 | constructor init of field second [pre-this] | |
| stl.h:385:9:385:9 | constructor init of field first [pre-this] | stl.h:385:9:385:9 | constructor init of field second [pre-this] | |
| stl.h:385:9:385:9 | this | stl.h:385:9:385:9 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:3 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:3:392:6 | this | stl.h:392:36:392:43 | constructor init of field first [pre-this] | |
| stl.h:392:18:392:18 | x | stl.h:392:18:392:18 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:18:392:18 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:18:392:18 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:18:392:18 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:18:392:18 | x | stl.h:392:42:392:42 | x | |
| stl.h:392:31:392:31 | y | stl.h:392:31:392:31 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:31:392:31 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:31:392:31 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:31:392:31 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:31:392:31 | y | stl.h:392:53:392:53 | y | |
| stl.h:392:36:392:43 | call to unknown function | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [post-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:36:392:43 | constructor init of field first [pre-this] | stl.h:392:46:392:54 | constructor init of field second [pre-this] | |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:42:392:42 | x | stl.h:392:36:392:43 | constructor init of field first | TAINT |
| stl.h:392:46:392:54 | call to unknown function | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:392:53:392:53 | y | stl.h:392:46:392:54 | constructor init of field second | TAINT |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:398:109:398:109 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:109:398:109 | x | stl.h:399:40:399:40 | x | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:398:117:398:117 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:398:117:398:117 | y | stl.h:399:61:399:61 | y | |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:10:399:63 | call to pair | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:398:109:398:109 | x | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:398:109:398:109 | x | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:398:109:398:109 | x | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:398:109:398:109 | x | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:399:40:399:40 | x [inner post update] | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:399:40:399:40 | x [inner post update] | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:399:40:399:40 | x [inner post update] | |
| stl.h:399:23:399:38 | ref arg call to forward | stl.h:399:40:399:40 | x [inner post update] | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:40:399:40 | x | stl.h:399:23:399:38 | call to forward | |
| stl.h:399:44:399:59 | call to forward | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:44:399:59 | call to forward | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:398:117:398:117 | y | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:398:117:398:117 | y | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:398:117:398:117 | y | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:398:117:398:117 | y | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:399:61:399:61 | y [inner post update] | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:399:61:399:61 | y [inner post update] | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:399:61:399:61 | y [inner post update] | |
| stl.h:399:44:399:59 | ref arg call to forward | stl.h:399:61:399:61 | y [inner post update] | |
| stl.h:399:61:399:61 | y | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:61:399:61 | y | stl.h:399:10:399:63 | call to pair | TAINT |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| stl.h:399:61:399:61 | y | stl.h:399:44:399:59 | call to forward | |
| string.cpp:25:12:25:17 | call to source | string.cpp:29:7:29:7 | a | |
| string.cpp:26:16:26:20 | 123 | string.cpp:26:16:26:21 | call to basic_string | TAINT |
| string.cpp:26:16:26:21 | call to basic_string | string.cpp:30:7:30:7 | b | |
@@ -7096,3 +7111,40 @@
| vector.cpp:413:11:413:16 | call to source | vector.cpp:413:2:413:2 | call to operator* [post update] | TAINT |
| vector.cpp:413:11:413:16 | call to source | vector.cpp:413:2:413:18 | ... = ... | |
| vector.cpp:414:7:414:9 | ref arg v14 | vector.cpp:415:1:415:1 | v14 | |
| vector.cpp:417:33:417:45 | source_string | vector.cpp:421:23:421:35 | source_string | |
| vector.cpp:417:33:417:45 | source_string | vector.cpp:428:23:428:35 | source_string | |
| vector.cpp:419:28:419:30 | call to vector | vector.cpp:420:13:420:15 | out | |
| vector.cpp:419:28:419:30 | call to vector | vector.cpp:422:8:422:10 | out | |
| vector.cpp:419:28:419:30 | call to vector | vector.cpp:423:2:423:2 | out | |
| vector.cpp:420:13:420:15 | out | vector.cpp:420:17:420:19 | call to end | TAINT |
| vector.cpp:420:13:420:15 | ref arg out | vector.cpp:422:8:422:10 | out | |
| vector.cpp:420:13:420:15 | ref arg out | vector.cpp:423:2:423:2 | out | |
| vector.cpp:420:17:420:19 | call to end | vector.cpp:421:4:421:5 | it | |
| vector.cpp:421:3:421:3 | call to operator* [post update] | vector.cpp:422:8:422:10 | out | |
| vector.cpp:421:3:421:3 | call to operator* [post update] | vector.cpp:423:2:423:2 | out | |
| vector.cpp:421:3:421:36 | ... = ... | vector.cpp:421:3:421:3 | call to operator* [post update] | |
| vector.cpp:421:4:421:5 | it | vector.cpp:421:6:421:6 | call to operator++ | |
| vector.cpp:421:6:421:6 | call to operator++ | vector.cpp:421:3:421:3 | call to operator* | TAINT |
| vector.cpp:421:11:421:36 | call to basic_string | vector.cpp:421:3:421:3 | call to operator* [post update] | TAINT |
| vector.cpp:421:11:421:36 | call to basic_string | vector.cpp:421:3:421:36 | ... = ... | |
| vector.cpp:421:23:421:35 | source_string | vector.cpp:421:11:421:36 | call to basic_string | TAINT |
| vector.cpp:422:8:422:10 | ref arg out | vector.cpp:423:2:423:2 | out | |
| vector.cpp:426:28:426:30 | call to vector | vector.cpp:427:32:427:34 | out | |
| vector.cpp:426:28:426:30 | call to vector | vector.cpp:429:8:429:10 | out | |
| vector.cpp:426:28:426:30 | call to vector | vector.cpp:430:2:430:2 | out | |
| vector.cpp:427:13:427:30 | call to back_inserter | vector.cpp:428:4:428:5 | it | |
| vector.cpp:427:32:427:34 | ref arg out | vector.cpp:429:8:429:10 | out | |
| vector.cpp:427:32:427:34 | ref arg out | vector.cpp:430:2:430:2 | out | |
| vector.cpp:428:4:428:5 | it | vector.cpp:428:6:428:6 | call to operator++ | |
| vector.cpp:428:6:428:6 | call to operator++ | vector.cpp:428:3:428:3 | call to operator* | TAINT |
| vector.cpp:428:23:428:35 | source_string | vector.cpp:428:11:428:36 | call to basic_string | TAINT |
| vector.cpp:429:8:429:10 | ref arg out | vector.cpp:430:2:430:2 | out | |
| vector.cpp:433:20:433:22 | call to vector | vector.cpp:434:32:434:34 | out | |
| vector.cpp:433:20:433:22 | call to vector | vector.cpp:436:8:436:10 | out | |
| vector.cpp:433:20:433:22 | call to vector | vector.cpp:437:2:437:2 | out | |
| vector.cpp:434:13:434:30 | call to back_inserter | vector.cpp:435:4:435:5 | it | |
| vector.cpp:434:32:434:34 | ref arg out | vector.cpp:436:8:436:10 | out | |
| vector.cpp:434:32:434:34 | ref arg out | vector.cpp:437:2:437:2 | out | |
| vector.cpp:435:4:435:5 | it | vector.cpp:435:6:435:6 | call to operator++ | |
| vector.cpp:435:6:435:6 | call to operator++ | vector.cpp:435:3:435:3 | call to operator* | TAINT |
| vector.cpp:436:8:436:10 | ref arg out | vector.cpp:437:2:437:2 | out | |

51
cpp/ql/test/library-tests/dataflow/taint-tests/stl.h
View File

@@ -68,6 +68,57 @@ namespace std {
struct forward_iterator_tag : public input_iterator_tag {};
struct bidirectional_iterator_tag : public forward_iterator_tag {};
struct random_access_iterator_tag : public bidirectional_iterator_tag {};
struct output_iterator_tag {};
template<class Container>
class back_insert_iterator {
protected:
Container* container = nullptr;
public:
using iterator_category = output_iterator_tag;
using value_type = void;
using difference_type = ptrdiff_t;
using pointer = void;
using reference = void;
using container_type = Container;
constexpr back_insert_iterator() noexcept = default;
constexpr explicit back_insert_iterator(Container& x);
constexpr back_insert_iterator& operator=(const typename Container::value_type& value);
constexpr back_insert_iterator& operator=(typename Container::value_type&& value);
constexpr back_insert_iterator& operator*();
constexpr back_insert_iterator& operator++();
constexpr back_insert_iterator operator++(int);
};
template<class Container>
constexpr back_insert_iterator<Container> back_inserter(Container& x) {
return back_insert_iterator<Container>(x);
}
template<class Container>
class front_insert_iterator {
protected:
Container* container = nullptr;
public:
using iterator_category = output_iterator_tag;
using value_type = void;
using difference_type = ptrdiff_t;
using pointer = void;
using reference = void;
using container_type = Container;
constexpr front_insert_iterator() noexcept = default;
constexpr explicit front_insert_iterator(Container& x);
constexpr front_insert_iterator& operator=(const typename Container::value_type& value);
constexpr front_insert_iterator& operator=(typename Container::value_type&& value);
constexpr front_insert_iterator& operator*();
constexpr front_insert_iterator& operator++();
constexpr front_insert_iterator operator++(int);
};
template<class Container>
constexpr front_insert_iterator<Container> front_inserter(Container& x) {
return front_insert_iterator<Container>(x);
}
}
// --- string ---

1
cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
View File

@@ -656,3 +656,4 @@
| vector.cpp:405:7:405:9 | v12 | vector.cpp:404:9:404:14 | call to source |
| vector.cpp:409:7:409:9 | v13 | vector.cpp:408:11:408:16 | call to source |
| vector.cpp:414:7:414:9 | v14 | vector.cpp:413:11:413:16 | call to source |
| vector.cpp:422:8:422:10 | out | vector.cpp:417:33:417:45 | source_string |

1
cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected
View File

@@ -382,3 +382,4 @@
| vector.cpp:405:7:405:9 | vector.cpp:404:9:404:14 | AST only |
| vector.cpp:409:7:409:9 | vector.cpp:408:11:408:16 | AST only |
| vector.cpp:414:7:414:9 | vector.cpp:413:11:413:16 | AST only |
| vector.cpp:422:8:422:10 | vector.cpp:417:33:417:45 | AST only |

25
cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
View File

@@ -11,7 +11,7 @@ namespace ns_int
}
void sink(int);
void sink(std::vector<int> &);
template<typename T> void sink(std::vector<T> &);
void test_range_based_for_loop_vector(int source1) {
std::vector<int> v(100, source1);
@@ -413,3 +413,26 @@ void test_vector_output_iterator(int b) {
*i14++ = source();
sink(v14); // tainted [NOT DETECTED by IR]
}
void test_vector_inserter(char *source_string) {
{
std::vector<std::string> out;
auto it = out.end();
*it++ = std::string(source_string);
sink(out); // tainted [NOT DETECTED by IR]
}
{
std::vector<std::string> out;
auto it = std::back_inserter(out);
*it++ = std::string(source_string);
sink(out); // tainted [NOT DETECTED]
}
{
std::vector<int> out;
auto it = std::back_inserter(out);
*it++ = source();
sink(out); // tainted [NOT DETECTED]
}
}