hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 20:58:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: emplace and emplace_back takes its arguments by universal references, so they should also specify flow as indirections.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2021-02-04 11:16:27 +01:00
parent 8cf8b704c5
commit 47ab9ba81b
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/src/semmle/code/cpp/models/implementations/StdContainer.qll
View File

@@ -193,7 +193,7 @@ class StdVectorEmplace extends TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from any parameter except the position iterator to qualifier and return value
// (here we assume taint flow from any constructor parameter to the constructed object)
input.isParameter([1 .. getNumberOfParameters() - 1]) and
input.isParameterDeref([1 .. getNumberOfParameters() - 1]) and
(
output.isQualifierObject() or
output.isReturnValue()
@@ -210,7 +210,7 @@ class StdVectorEmplaceBack extends TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from any parameter to qualifier
// (here we assume taint flow from any constructor parameter to the constructed object)
input.isParameter([0 .. getNumberOfParameters() - 1]) and
input.isParameterDeref([0 .. getNumberOfParameters() - 1]) and
output.isQualifierObject()
}
}

4
cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
View File

@@ -491,8 +491,8 @@ void test_vector_emplace() {
std::vector<int> v1(10), v2(10);
v1.emplace_back(source());
sink(v1); // $ ast MISSING: ir
sink(v1); // $ ast,ir
v2.emplace(v2.begin(), source());
sink(v2); // $ ast MISSING: ir
sink(v2); // $ ast,ir
}