hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-24 16:25:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Correct some existing cases that are in fact indirect.

Browse Source
This commit is contained in:
Geoffrey White
2024-03-13 11:55:47 +00:00
parent 9aad43f649
commit 92d57ab504
3 changed files with 13 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
cpp/ql/test/library-tests/dataflow/models-as-data/FlowSummaryNode.expected
View File

@@ -2,9 +2,6 @@
| tests.cpp:115:5:115:19 | [summary] to write: ReturnValue in madArg0ToReturn | ReturnNode | madArg0ToReturn | madArg0ToReturn |
| tests.cpp:117:5:117:28 | [summary param] 0 in madArg0ToReturnValueFlow | ParameterNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
| tests.cpp:117:5:117:28 | [summary] to write: ReturnValue in madArg0ToReturnValueFlow | ReturnNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
| tests.cpp:119:6:119:18 | [summary param] 0 in madArg0ToArg1 | ParameterNode | madArg0ToArg1 | madArg0ToArg1 |
| tests.cpp:119:6:119:18 | [summary param] 1 in madArg0ToArg1 | ParameterNode | madArg0ToArg1 | madArg0ToArg1 |
| tests.cpp:119:6:119:18 | [summary] to write: Argument[1] in madArg0ToArg1 | PostUpdateNode | madArg0ToArg1 | madArg0ToArg1 |
| tests.cpp:180:7:180:19 | [summary param] 0 in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
| tests.cpp:180:7:180:19 | [summary param] this indirection in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
| tests.cpp:180:7:180:19 | [summary] to write: Argument[this indirection] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf |

9
cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll
View File

@@ -12,14 +12,15 @@ private class TestSources extends SourceModelCsv {
";;false;localMadSourceVoid;;;ReturnValue;local",
";;false;localMadSourceHasBody;;;ReturnValue;local",
";;false;remoteMadSourceIndirect;;;*ReturnValue;remote",
";;false;remoteMadSourceArg0;;;Argument[0];remote",
";;false;remoteMadSourceArg1;;;Argument[1];remote", ";;false;remoteMadSourceVar;;;;remote",
";;false;remoteMadSourceIndirectArg0;;;*Argument[0];remote",
";;false;remoteMadSourceIndirectArg1;;;*Argument[1];remote",
";;false;remoteMadSourceVar;;;;remote",
";;false;remoteMadSourceParam0;;;Parameter[0];remote",
"MyNamespace;;false;namespaceLocalMadSource;;;ReturnValue;local",
"MyNamespace;;false;namespaceLocalMadSourceVar;;;;local",
"MyNamespace::MyNamespace2;;false;namespace2LocalMadSource;;;ReturnValue;local",
";MyClass;true;memberRemoteMadSource;;;ReturnValue;remote",
";MyClass;true;memberRemoteMadSourceArg0;;;Argument[0];remote",
";MyClass;true;memberRemoteMadSourceIndirectArg0;;;*Argument[0];remote",
";MyClass;true;memberRemoteMadSourceVar;;;;remote",
";MyClass;true;subtypeRemoteMadSource1;;;ReturnValue;remote",
";MyClass;false;subtypeNonSource;;;ReturnValue;remote", // the tests define this in MyDerivedClass, so it should *not* be recongized as a source
@@ -61,7 +62,7 @@ private class TestSummaries extends SummaryModelCsv {
";;false;madArg0ToReturn;;;Argument[0];ReturnValue;taint",
";;false;madArg0ToReturnValueFlow;;;Argument[0];ReturnValue;value",
";;false;madArg0IndirectToReturn;;;*Argument[0];ReturnValue;taint",
";;false;madArg0ToArg1;;;Argument[0];Argument[1];taint",
";;false;madArg0ToArg1Indirect;;;Argument[0];*Argument[1];taint",
";;false;madArg0IndirectToArg1Indirect;;;*Argument[0];*Argument[1];taint",
";;false;madArg0FieldToReturn;;;Argument[0].value;ReturnValue;taint",
";;false;madArg0IndirectFieldToReturn;;;*Argument[0].value;ReturnValue;taint",

16
cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp
View File

@@ -11,8 +11,8 @@ int notASource();
int localMadSourceVoid(void); // $ interpretElement
int localMadSourceHasBody() { return 0; } // $ interpretElement
int *remoteMadSourceIndirect(); // $ interpretElement
void remoteMadSourceArg0(int *x, int *y); // $ interpretElement
void remoteMadSourceArg1(int &x, int &y); // $ interpretElement
void remoteMadSourceIndirectArg0(int *x, int *y); // $ interpretElement
void remoteMadSourceIndirectArg1(int &x, int &y); // $ interpretElement
int remoteMadSourceVar; // $ interpretElement
namespace MyNamespace {
@@ -42,10 +42,10 @@ void test_sources() {
int a, b, c, d;
remoteMadSourceArg0(&a, &b);
remoteMadSourceIndirectArg0(&a, &b);
sink(a); // $ MISSING: ir
sink(a);
remoteMadSourceArg1(c, d);
remoteMadSourceIndirectArg1(c, d);
sink(c);
sink(d); // $ MISSING: ir
@@ -116,7 +116,7 @@ int madArg0ToReturn(int x); // $ interpretElement
int notASummary(int x);
int madArg0ToReturnValueFlow(int x); // $ interpretElement
int madArg0IndirectToReturn(int *x); // $ interpretElement
void madArg0ToArg1(int x, int &y); // $ interpretElement
void madArg0ToArg1Indirect(int x, int &y); // $ interpretElement
void madArg0IndirectToArg1Indirect(const int *x, int *y); // $ interpretElement
int madArg0FieldToReturn(MyContainer mc); // $ interpretElement
@@ -137,7 +137,7 @@ void test_summaries() {
a = source();
sink(madArg0IndirectToReturn(&a)); // $ MISSING: ir
madArg0ToArg1(source(), b);
madArg0ToArg1Indirect(source(), b);
sink(b); // $ MISSING: ir
madArg0IndirectToArg1Indirect(&a, &c);
@@ -169,7 +169,7 @@ class MyClass {
public:
// sources
int memberRemoteMadSource(); // $ interpretElement
void memberRemoteMadSourceArg0(int *x); // $ interpretElement
void memberRemoteMadSourceIndirectArg0(int *x); // $ interpretElement
int memberRemoteMadSourceVar; // $ interpretElement
// sinks
@@ -224,7 +224,7 @@ void test_class_members() {
sink(mc.memberRemoteMadSource()); // $ ir
int a;
mc.memberRemoteMadSourceArg0(&a);
mc.memberRemoteMadSourceIndirectArg0(&a);
sink(a); // $ MISSING: ir
sink(mc.memberRemoteMadSourceVar); // $ ir