hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20769 from MathiasVP/add-more-flow-models

Browse Source 
C++: Add a few more models
This commit is contained in:
Mathias Vorreiter Pedersen
2025-11-08 16:39:29 +00:00
committed by GitHub
parent dbadb6f738 56b9566299
commit 74b774eec5
9 changed files with 278 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
cpp/ql/lib/ext/cctype.model.yml Normal file
View File

@@ -0,0 +1,9 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["", "", False, "tolower", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["std", "", False, "tolower", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["", "", False, "toupper", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
- ["std", "", False, "toupper", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]

7
cpp/ql/lib/ext/iconv.model.yml Normal file
View File

@@ -0,0 +1,7 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["", "", False, "iconv", "", "", "Argument[**1]", "Argument[**3]", "value", "manual"]

8
cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll
View File

@@ -12,8 +12,8 @@ import semmle.code.cpp.models.interfaces.Taint
import semmle.code.cpp.models.interfaces.NonThrowing
/**
* The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant
* `__builtin___memcpy_chk`.
* The standard functions `memcpy`, `memmove` and `bcopy`; and variants such as
* `__builtin___memcpy_chk` and `__builtin___memmove_chk`.
*/
private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction,
AliasFunction, NonCppThrowingFunction
@@ -27,7 +27,9 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
// bcopy(src, dest, num)
// mempcpy(dest, src, num)
// memccpy(dest, src, c, n)
this.hasGlobalName(["bcopy", mempcpy(), "memccpy", "__builtin___memcpy_chk"])
this.hasGlobalName([
"bcopy", mempcpy(), "memccpy", "__builtin___memcpy_chk", "__builtin___memmove_chk"
])
}
/**

5
cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll
View File

@@ -19,7 +19,8 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
this.hasGlobalOrStdName("wmemset")
or
this.hasGlobalName([
bzero(), "__builtin_memset", "__builtin_memset_chk", "RtlZeroMemory", "RtlSecureZeroMemory"
bzero(), "__builtin_memset", "__builtin_memset_chk", "__builtin___memset_chk",
"RtlZeroMemory", "RtlSecureZeroMemory"
])
}
@@ -32,7 +33,7 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
or
this.hasGlobalOrStdName("wmemset")
or
this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk"])
this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk", "__builtin___memset_chk"])
) and
result = 1
}

6
cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll
View File

@@ -30,7 +30,9 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
"_mbsncat", // _mbsncat(dst, src, max_amount)
"_mbsncat_l", // _mbsncat_l(dst, src, max_amount, locale)
"_mbsnbcat", // _mbsnbcat(dest, src, count)
"_mbsnbcat_l" // _mbsnbcat_l(dest, src, count, locale)
"_mbsnbcat_l", // _mbsnbcat_l(dest, src, count, locale)
"__builtin___strcat_chk", // __builtin___strcat_chk (dest, src, magic)
"__builtin___strncat_chk" // __builtin___strncat_chk (dest, src, max_amount, magic)
])
}
@@ -56,7 +58,7 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
(
this.getName() = ["strncat", "wcsncat", "_mbsncat", "_mbsncat_l"] and
this.getName() = ["strncat", "wcsncat", "_mbsncat", "_mbsncat_l", "__builtin___strncat_chk"] and
input.isParameter(2)
or
this.getName() = ["_mbsncat_l", "_mbsnbcat_l"] and

6
cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll
View File

@@ -36,7 +36,11 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
"_mbsnbcpy", // _mbsnbcpy(dest, src, max_amount)
"stpcpy", // stpcpy(dest, src)
"stpncpy", // stpncpy(dest, src, max_amount)
"strlcpy" // strlcpy(dst, src, dst_size)
"strlcpy", // strlcpy(dst, src, dst_size)
"__builtin___strcpy_chk", // __builtin___strcpy_chk (dest, src, magic)
"__builtin___stpcpy_chk", // __builtin___stpcpy_chk (dest, src, magic)
"__builtin___stpncpy_chk", // __builtin___stpncpy_chk(dest, src, max_amount, magic)
"__builtin___strncpy_chk" // __builtin___strncpy_chk (dest, src, max_amount, magic)
])
or
(

20
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -7988,6 +7988,26 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| taint.cpp:841:21:841:35 | call to indirect_source | taint.cpp:843:16:843:17 | fp | |
| taint.cpp:842:11:842:12 | ref arg fp | taint.cpp:843:16:843:17 | fp | |
| taint.cpp:842:15:842:16 | | taint.cpp:842:11:842:12 | ref arg fp | TAINT |
| taint.cpp:851:10:851:15 | call to source | taint.cpp:852:18:852:18 | s | |
| taint.cpp:851:10:851:15 | call to source | taint.cpp:854:18:854:18 | s | |
| taint.cpp:852:10:852:16 | call to toupper | taint.cpp:853:7:853:7 | u | |
| taint.cpp:854:10:854:16 | call to tolower | taint.cpp:855:7:855:7 | l | |
| taint.cpp:861:24:861:27 | size | taint.cpp:866:16:866:19 | size | |
| taint.cpp:862:12:862:26 | call to indirect_source | taint.cpp:866:12:866:12 | s | |
| taint.cpp:863:7:863:9 | out | taint.cpp:864:12:864:14 | out | |
| taint.cpp:864:12:864:14 | out | taint.cpp:866:23:866:23 | p | |
| taint.cpp:864:12:864:14 | out | taint.cpp:867:8:867:8 | p | |
| taint.cpp:865:9:865:16 | size_out | taint.cpp:866:27:866:34 | size_out | |
| taint.cpp:866:11:866:12 | ref arg & ... | taint.cpp:866:12:866:12 | s [inner post update] | |
| taint.cpp:866:12:866:12 | s | taint.cpp:866:11:866:12 | & ... | |
| taint.cpp:866:15:866:19 | ref arg & ... | taint.cpp:866:16:866:19 | size [inner post update] | |
| taint.cpp:866:16:866:19 | size | taint.cpp:866:15:866:19 | & ... | |
| taint.cpp:866:22:866:23 | ref arg & ... | taint.cpp:866:23:866:23 | p [inner post update] | |
| taint.cpp:866:22:866:23 | ref arg & ... | taint.cpp:867:8:867:8 | p | |
| taint.cpp:866:23:866:23 | p | taint.cpp:866:22:866:23 | & ... | |
| taint.cpp:866:26:866:34 | ref arg & ... | taint.cpp:866:27:866:34 | size_out [inner post update] | |
| taint.cpp:866:27:866:34 | size_out | taint.cpp:866:26:866:34 | & ... | |
| taint.cpp:867:8:867:8 | p | taint.cpp:867:7:867:8 | * ... | TAINT |
| thread.cpp:10:27:10:27 | s | thread.cpp:10:27:10:27 | s | |
| thread.cpp:10:27:10:27 | s | thread.cpp:11:8:11:8 | s | |
| thread.cpp:14:26:14:26 | s | thread.cpp:15:8:15:8 | s | |

23
cpp/ql/test/library-tests/dataflow/taint-tests/taint.cpp
View File

@@ -842,4 +842,27 @@ int f7(void)
fprintf(fp, "");
indirect_sink(fp); // $ ir MISSING: ast
return 0;
}
int toupper(int);
int tolower(int);
void test_toupper_and_tolower() {
int s = source();
int u = toupper(s);
sink(u); // $ ir MISSING: ast
int l = tolower(s);
sink(l); // $ ir MISSING: ast
}
typedef int iconv_t;
size_t iconv(iconv_t cd, char **, size_t *, char **, size_t *);
void test_iconv(size_t size) {
char* s = indirect_source();
char out[10];
char* p = out;
size_t size_out;
iconv(0, &s, &size, &p, &size_out);
sink(*p); // $ ast,ir
}

202
cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected
View File

@@ -17746,6 +17746,196 @@ signatureMatches
| taint.cpp:837:5:837:11 | fprintf | (char **,const char *,...) | | ___asprintf | 1 |
| taint.cpp:837:5:837:11 | fprintf | (char **,const char *,...) | | ___asprintf | 2 |
| taint.cpp:837:5:837:11 | fprintf | (curl_httppost **,curl_httppost **,...) | | curl_formadd | 2 |
| taint.cpp:847:5:847:11 | toupper | (int) | | ASN1_STRING_type_new | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | ASN1_tag2bit | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | ASN1_tag2str | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | EVP_PKEY_asn1_get0 | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | Jim_ReturnCode | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | Jim_SignalId | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | OBJ_nid2ln | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | OBJ_nid2obj | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | OBJ_nid2sn | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | OSSL_STORE_INFO_type_string | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | OSSL_trace_get_category_name | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | PKCS12_init | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | Symbol_Nth | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | X509_PURPOSE_get0 | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | X509_PURPOSE_get_by_id | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | X509_TRUST_get0 | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | X509_TRUST_get_by_id | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | X509_VERIFY_PARAM_get0 | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __btowc | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __current_locale_name | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __fdopendir | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __get_errlist | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __get_errname | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __math_invalid_i | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __math_invalidf_i | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __p_class | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __p_rcode | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __p_type | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __pkey_get | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __sigdescr_np | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | __strerrordesc_np | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | _tolower | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | _toupper | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | btowc | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | c_tolower | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | c_toupper | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | curlx_sitouz | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | evp_pkey_type2name | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | inet6_option_space | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isalnum | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isalpha | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isblank | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | iscntrl | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isdigit | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isgraph | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | islower | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isprint | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | ispunct | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isspace | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isupper | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | isxdigit | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | ossl_cmp_bodytype_to_string | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | ossl_tolower | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | ossl_toupper | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | sigabbrev_np | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | sqlite3_compileoption_get | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | sqlite3_errstr | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | strerrorname_np | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | support_report_failure | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | svcudp_create | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | tls13_alert_code | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | toascii | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | tolower | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | toupper | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | uabs | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | uv__accept | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | uv_err_name | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | uv_get_osfhandle | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | uv_strerror | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | uv_translate_sys_error | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | | zError | 0 |
| taint.cpp:847:5:847:11 | toupper | (int) | __pthread_cleanup_class | __setdoit | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | ASN1_STRING_type_new | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | ASN1_tag2bit | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | ASN1_tag2str | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | EVP_PKEY_asn1_get0 | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | Jim_ReturnCode | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | Jim_SignalId | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | OBJ_nid2ln | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | OBJ_nid2obj | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | OBJ_nid2sn | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | OSSL_STORE_INFO_type_string | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | OSSL_trace_get_category_name | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | PKCS12_init | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | Symbol_Nth | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | X509_PURPOSE_get0 | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | X509_PURPOSE_get_by_id | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | X509_TRUST_get0 | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | X509_TRUST_get_by_id | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | X509_VERIFY_PARAM_get0 | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __btowc | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __current_locale_name | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __fdopendir | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __get_errlist | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __get_errname | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __math_invalid_i | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __math_invalidf_i | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __p_class | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __p_rcode | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __p_type | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __pkey_get | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __sigdescr_np | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | __strerrordesc_np | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | _tolower | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | _toupper | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | btowc | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | c_tolower | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | c_toupper | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | curlx_sitouz | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | evp_pkey_type2name | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | inet6_option_space | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isalnum | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isalpha | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isblank | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | iscntrl | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isdigit | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isgraph | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | islower | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isprint | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | ispunct | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isspace | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isupper | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | isxdigit | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | ossl_cmp_bodytype_to_string | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | ossl_tolower | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | ossl_toupper | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | sigabbrev_np | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | sqlite3_compileoption_get | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | sqlite3_errstr | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | strerrorname_np | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | support_report_failure | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | svcudp_create | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | tls13_alert_code | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | toascii | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | tolower | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | toupper | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | uabs | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | uv__accept | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | uv_err_name | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | uv_get_osfhandle | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | uv_strerror | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | uv_translate_sys_error | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | | zError | 0 |
| taint.cpp:848:5:848:11 | tolower | (int) | __pthread_cleanup_class | __setdoit | 0 |
| taint.cpp:859:8:859:12 | iconv | (ASYNC_WAIT_CTX *,int *,size_t *,int *,size_t *) | | ASYNC_WAIT_CTX_get_changed_fds | 4 |
| taint.cpp:859:8:859:12 | iconv | (Curl_easy *,Curl_chunker *,char *,size_t,size_t *) | | Curl_httpchunk_read | 4 |
| taint.cpp:859:8:859:12 | iconv | (Curl_easy *,const void *,size_t,bool,size_t *) | | Curl_xfer_send | 4 |
| taint.cpp:859:8:859:12 | iconv | (Curl_easy *,int,pingpong *,int *,size_t *) | | Curl_pp_readresp | 4 |
| taint.cpp:859:8:859:12 | iconv | (OSSL_RECORD_LAYER *,uint8_t,size_t,size_t,size_t *) | | tls_get_max_records_default | 4 |
| taint.cpp:859:8:859:12 | iconv | (OSSL_RECORD_LAYER *,uint8_t,size_t,size_t,size_t *) | | tls_get_max_records_multiblock | 4 |
| taint.cpp:859:8:859:12 | iconv | (QUIC_SSTREAM *,size_t,OSSL_QUIC_FRAME_STREAM *,OSSL_QTX_IOVEC *,size_t *) | | ossl_quic_sstream_get_stream_frame | 4 |
| taint.cpp:859:8:859:12 | iconv | (QUIC_TSERVER *,uint64_t,const unsigned char *,size_t,size_t *) | | ossl_quic_tserver_write | 4 |
| taint.cpp:859:8:859:12 | iconv | (QUIC_TSERVER *,uint64_t,unsigned char *,size_t,size_t *) | | ossl_quic_tserver_read | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL *,const void *,size_t,uint64_t,size_t *) | | SSL_write_ex2 | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL *,const void *,size_t,uint64_t,size_t *) | | ossl_quic_write_flags | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL *,const void *,size_t,uint64_t,size_t *) | | ssl_write_internal | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL *,int *,size_t *,int *,size_t *) | | SSL_get_changed_async_fds | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL *,uint8_t,const void *,size_t,size_t *) | | dtls1_write_app_data_bytes | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL *,uint8_t,const void *,size_t,size_t *) | | ssl3_write_bytes | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL_CONNECTION *,uint8_t,const unsigned char *,size_t,size_t *) | | do_dtls1_write | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL_CONNECTION *,uint8_t,const void *,size_t,size_t *) | | dtls1_write_bytes | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL_CONNECTION *,unsigned char *,unsigned char *,size_t,size_t *) | | ssl3_generate_master_secret | 4 |
| taint.cpp:859:8:859:12 | iconv | (SSL_CTX *,const SSL_CIPHER *,const EVP_MD **,int *,size_t *) | | ssl_cipher_get_evp_md_mac | 4 |
| taint.cpp:859:8:859:12 | iconv | (loaded_l10nfile *,binding *,const char *,int,size_t *) | | _nl_find_msg | 4 |
| taint.cpp:859:8:859:12 | iconv | (unsigned char *,size_t *,size_t,const unsigned char **,size_t *) | | ossl_cipher_fillblock | 4 |
| taint.cpp:859:8:859:12 | iconv | (unsigned char *,size_t *,size_t,const unsigned char **,size_t *) | | ossl_cipher_trailingdata | 4 |
| taint.cpp:859:8:859:12 | iconv | (unsigned long *,unsigned long *,unsigned long *,int,unsigned long *) | | bn_mul_low_recursive | 4 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | BrotliEncoderMaxCompressedSize | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | EVP_PKEY_meth_get0 | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | __libc_malloc | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | __libc_valloc | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | _dl_early_allocate | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | curlx_uztosi | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | curlx_uztosz | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | curlx_uztoui | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | curlx_uztoul | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | malloc | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | ossl_get_extension_type | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | ossl_param_bytes_to_blocks | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | ossl_quic_sstream_new | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | ssl_cert_new | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | support_next_to_fault_allocate | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | support_next_to_fault_allocate_before | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | support_stack_alloc | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (size_t) | | xalloc_sigstack | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (unsigned long) | | BN_num_bits_word | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (unsigned long) | | BUF_MEM_new_ex | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (unsigned long) | | curlx_ultouc | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (unsigned long) | | curlx_ultous | 0 |
| taint.cpp:861:6:861:15 | test_iconv | (unsigned long) | | next_prime | 0 |
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_STRING_type_new | 0 |
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_tag2bit | 0 |
| thread.cpp:4:6:4:9 | sink | (int) | | ASN1_tag2str | 0 |
@@ -47303,6 +47493,18 @@ getParameterTypeName
| taint.cpp:837:5:837:11 | fprintf | 0 | FILE * |
| taint.cpp:837:5:837:11 | fprintf | 1 | const char * |
| taint.cpp:837:5:837:11 | fprintf | 2 | ... |
| taint.cpp:847:5:847:11 | toupper | 0 | int |
| taint.cpp:848:5:848:11 | tolower | 0 | int |
| taint.cpp:859:8:859:12 | iconv | 0 | iconv_t |
| taint.cpp:859:8:859:12 | iconv | 0 | int |
| taint.cpp:859:8:859:12 | iconv | 1 | char ** |
| taint.cpp:859:8:859:12 | iconv | 2 | size_t * |
| taint.cpp:859:8:859:12 | iconv | 2 | unsigned long * |
| taint.cpp:859:8:859:12 | iconv | 3 | char ** |
| taint.cpp:859:8:859:12 | iconv | 4 | size_t * |
| taint.cpp:859:8:859:12 | iconv | 4 | unsigned long * |
| taint.cpp:861:6:861:15 | test_iconv | 0 | size_t |
| taint.cpp:861:6:861:15 | test_iconv | 0 | unsigned long |
| thread.cpp:4:6:4:9 | sink | 0 | int |
| thread.cpp:6:8:6:8 | operator= | 0 | S && |
| thread.cpp:6:8:6:8 | operator= | 0 | const S & |