hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: simple tests for vector output iterators

Browse Source
This commit is contained in:
Robert Marsh
2020-08-25 15:21:16 -07:00
parent 9879c6c204
commit 983f54f11a
2 changed files with 109 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

82
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -3173,3 +3173,85 @@
| vector.cpp:324:7:324:8 | ref arg v2 | vector.cpp:327:1:327:1 | v2 | |
| vector.cpp:325:7:325:8 | ref arg v3 | vector.cpp:327:1:327:1 | v3 | |
| vector.cpp:326:7:326:8 | ref arg v4 | vector.cpp:327:1:327:1 | v4 | |
| vector.cpp:329:62:329:65 | iter | vector.cpp:330:3:330:6 | iter | |
| vector.cpp:330:2:330:17 | ... = ... | vector.cpp:330:2:330:2 | call to operator* [post update] | |
| vector.cpp:330:3:330:6 | iter | vector.cpp:330:2:330:2 | call to operator* | TAINT |
| vector.cpp:330:10:330:15 | call to source | vector.cpp:330:2:330:17 | ... = ... | |
| vector.cpp:334:22:334:24 | call to vector | vector.cpp:336:34:336:35 | v1 | |
| vector.cpp:334:22:334:24 | call to vector | vector.cpp:338:7:338:8 | v1 | |
| vector.cpp:334:22:334:24 | call to vector | vector.cpp:354:1:354:1 | v1 | |
| vector.cpp:334:30:334:32 | call to vector | vector.cpp:340:38:340:39 | v2 | |
| vector.cpp:334:30:334:32 | call to vector | vector.cpp:340:56:340:57 | v2 | |
| vector.cpp:334:30:334:32 | call to vector | vector.cpp:343:7:343:8 | v2 | |
| vector.cpp:334:30:334:32 | call to vector | vector.cpp:354:1:354:1 | v2 | |
| vector.cpp:334:38:334:40 | call to vector | vector.cpp:345:15:345:16 | v3 | |
| vector.cpp:334:38:334:40 | call to vector | vector.cpp:348:7:348:8 | v3 | |
| vector.cpp:334:38:334:40 | call to vector | vector.cpp:354:1:354:1 | v3 | |
| vector.cpp:334:46:334:48 | call to vector | vector.cpp:350:38:350:39 | v4 | |
| vector.cpp:334:46:334:48 | call to vector | vector.cpp:350:56:350:57 | v4 | |
| vector.cpp:334:46:334:48 | call to vector | vector.cpp:353:7:353:8 | v4 | |
| vector.cpp:334:46:334:48 | call to vector | vector.cpp:354:1:354:1 | v4 | |
| vector.cpp:336:34:336:35 | ref arg v1 | vector.cpp:338:7:338:8 | v1 | |
| vector.cpp:336:34:336:35 | ref arg v1 | vector.cpp:354:1:354:1 | v1 | |
| vector.cpp:336:34:336:35 | v1 | vector.cpp:336:37:336:41 | call to begin | TAINT |
| vector.cpp:336:37:336:41 | call to begin | vector.cpp:337:3:337:4 | i1 | |
| vector.cpp:337:2:337:15 | ... = ... | vector.cpp:337:2:337:2 | call to operator* [post update] | |
| vector.cpp:337:3:337:4 | i1 | vector.cpp:337:2:337:2 | call to operator* | TAINT |
| vector.cpp:337:8:337:13 | call to source | vector.cpp:337:2:337:15 | ... = ... | |
| vector.cpp:338:7:338:8 | ref arg v1 | vector.cpp:354:1:354:1 | v1 | |
| vector.cpp:340:38:340:39 | ref arg v2 | vector.cpp:340:56:340:57 | v2 | |
| vector.cpp:340:38:340:39 | ref arg v2 | vector.cpp:343:7:343:8 | v2 | |
| vector.cpp:340:38:340:39 | ref arg v2 | vector.cpp:354:1:354:1 | v2 | |
| vector.cpp:340:38:340:39 | v2 | vector.cpp:340:41:340:45 | call to begin | TAINT |
| vector.cpp:340:41:340:45 | call to begin | vector.cpp:340:50:340:51 | it | |
| vector.cpp:340:41:340:45 | call to begin | vector.cpp:340:68:340:69 | it | |
| vector.cpp:340:41:340:45 | call to begin | vector.cpp:341:4:341:5 | it | |
| vector.cpp:340:56:340:57 | ref arg v2 | vector.cpp:340:56:340:57 | v2 | |
| vector.cpp:340:56:340:57 | ref arg v2 | vector.cpp:343:7:343:8 | v2 | |
| vector.cpp:340:56:340:57 | ref arg v2 | vector.cpp:354:1:354:1 | v2 | |
| vector.cpp:340:56:340:57 | v2 | vector.cpp:340:59:340:61 | call to end | TAINT |
| vector.cpp:340:68:340:69 | it | vector.cpp:340:66:340:66 | call to operator++ | TAINT |
| vector.cpp:340:68:340:69 | ref arg it | vector.cpp:340:50:340:51 | it | |
| vector.cpp:340:68:340:69 | ref arg it | vector.cpp:340:68:340:69 | it | |
| vector.cpp:340:68:340:69 | ref arg it | vector.cpp:341:4:341:5 | it | |
| vector.cpp:341:3:341:16 | ... = ... | vector.cpp:341:3:341:3 | call to operator* [post update] | |
| vector.cpp:341:4:341:5 | it | vector.cpp:341:3:341:3 | call to operator* | TAINT |
| vector.cpp:341:9:341:14 | call to source | vector.cpp:341:3:341:16 | ... = ... | |
| vector.cpp:343:7:343:8 | ref arg v2 | vector.cpp:354:1:354:1 | v2 | |
| vector.cpp:345:15:345:15 | (__begin) | vector.cpp:345:15:345:15 | call to operator* | TAINT |
| vector.cpp:345:15:345:15 | (__begin) | vector.cpp:345:15:345:15 | call to operator++ | TAINT |
| vector.cpp:345:15:345:15 | (__end) | vector.cpp:345:15:345:15 | call to iterator | |
| vector.cpp:345:15:345:15 | (__range) | vector.cpp:345:15:345:15 | call to begin | TAINT |
| vector.cpp:345:15:345:15 | (__range) | vector.cpp:345:15:345:15 | call to end | TAINT |
| vector.cpp:345:15:345:15 | call to begin | vector.cpp:345:15:345:15 | (__begin) | |
| vector.cpp:345:15:345:15 | call to begin | vector.cpp:345:15:345:15 | (__begin) | |
| vector.cpp:345:15:345:15 | call to begin | vector.cpp:345:15:345:15 | (__begin) | |
| vector.cpp:345:15:345:15 | call to end | vector.cpp:345:15:345:15 | (__end) | |
| vector.cpp:345:15:345:15 | ref arg (__begin) | vector.cpp:345:15:345:15 | (__begin) | |
| vector.cpp:345:15:345:15 | ref arg (__begin) | vector.cpp:345:15:345:15 | (__begin) | |
| vector.cpp:345:15:345:15 | ref arg (__begin) | vector.cpp:345:15:345:15 | (__begin) | |
| vector.cpp:345:15:345:15 | ref arg (__range) | vector.cpp:345:15:345:15 | (__range) | |
| vector.cpp:345:15:345:16 | v3 | vector.cpp:345:15:345:15 | (__range) | |
| vector.cpp:345:15:345:16 | v3 | vector.cpp:345:15:345:15 | (__range) | |
| vector.cpp:345:15:345:16 | v3 | vector.cpp:345:15:345:15 | call to operator* | TAINT |
| vector.cpp:346:7:346:12 | call to source | vector.cpp:346:3:346:14 | ... = ... | |
| vector.cpp:348:7:348:8 | ref arg v3 | vector.cpp:354:1:354:1 | v3 | |
| vector.cpp:350:38:350:39 | ref arg v4 | vector.cpp:350:56:350:57 | v4 | |
| vector.cpp:350:38:350:39 | ref arg v4 | vector.cpp:353:7:353:8 | v4 | |
| vector.cpp:350:38:350:39 | ref arg v4 | vector.cpp:354:1:354:1 | v4 | |
| vector.cpp:350:38:350:39 | v4 | vector.cpp:350:41:350:45 | call to begin | TAINT |
| vector.cpp:350:41:350:45 | call to begin | vector.cpp:350:50:350:51 | it | |
| vector.cpp:350:41:350:45 | call to begin | vector.cpp:350:68:350:69 | it | |
| vector.cpp:350:41:350:45 | call to begin | vector.cpp:351:4:351:5 | it | |
| vector.cpp:350:56:350:57 | ref arg v4 | vector.cpp:350:56:350:57 | v4 | |
| vector.cpp:350:56:350:57 | ref arg v4 | vector.cpp:353:7:353:8 | v4 | |
| vector.cpp:350:56:350:57 | ref arg v4 | vector.cpp:354:1:354:1 | v4 | |
| vector.cpp:350:56:350:57 | v4 | vector.cpp:350:59:350:61 | call to end | TAINT |
| vector.cpp:350:68:350:69 | it | vector.cpp:350:66:350:66 | call to operator++ | TAINT |
| vector.cpp:350:68:350:69 | ref arg it | vector.cpp:350:50:350:51 | it | |
| vector.cpp:350:68:350:69 | ref arg it | vector.cpp:350:68:350:69 | it | |
| vector.cpp:350:68:350:69 | ref arg it | vector.cpp:351:4:351:5 | it | |
| vector.cpp:351:3:351:16 | ... = ... | vector.cpp:351:3:351:3 | call to operator* [post update] | |
| vector.cpp:351:4:351:5 | it | vector.cpp:351:3:351:3 | call to operator* | TAINT |
| vector.cpp:351:9:351:14 | call to source | vector.cpp:351:3:351:16 | ... = ... | |
| vector.cpp:353:7:353:8 | ref arg v4 | vector.cpp:354:1:354:1 | v4 | |

27
cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
View File

@@ -325,3 +325,30 @@ void test_constructors_more() {
sink(v3);
sink(v4); // tainted
}
void taint_vector_output_iterator(std::vector<int>::iterator iter) {
*iter = source();
}
void test_vector_output_iterator() {
std::vector<int> v1(10), v2(10), v3(10), v4(10);
std::vector<int>::iterator i1 = v1.begin();
*i1 = source();
sink(v1); // tainted [NOT DETECTED]
for(std::vector<int>::iterator it = v2.begin(); it != v2.end(); ++it) {
*it = source(); // tainted [NOT DETECTED]
}
sink(v2);
for(int& x : v3) {
x = source();
}
sink(v3); // tainted [NOT DETECTED]
for(std::vector<int>::iterator it = v4.begin(); it != v4.end(); ++it) {
*it = source();
}
sink(v4); // tainted [NOT DETECTED]
}