hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into aegilops/polyfill-io-compromised-script

Browse Source
This commit is contained in:
Paul Hodgkinson
2024-07-12 12:53:44 +01:00
committed by GitHub
parent 61df4d2f04 0839742daa
commit c9af53f050
519 changed files with 26045 additions and 4878 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
.devcontainer/swift/root.sh Normal file → Executable file
View File

@@ -3,6 +3,16 @@ set -xe
BAZELISK_VERSION=v1.12.0
BAZELISK_DOWNLOAD_SHA=6b0bcb2ea15bca16fffabe6fda75803440375354c085480fe361d2cbf32501db
# install git lfs apt source
curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash
# install gh apt source
(type -p wget >/dev/null || (sudo apt update && sudo apt-get install wget -y)) \
&& sudo mkdir -p -m 755 /etc/apt/keyrings \
&& wget -qO- https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
&& sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
apt-get update
export DEBIAN_FRONTEND=noninteractive
apt-get -y install --no-install-recommends \
@@ -10,7 +20,9 @@ apt-get -y install --no-install-recommends \
uuid-dev \
python3-distutils \
python3-pip \
bash-completion
bash-completion \
git-lfs \
gh
# Install Bazel
curl -fSsL -o /usr/local/bin/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/${BAZELISK_VERSION}/bazelisk-linux-amd64

2
.devcontainer/swift/user.sh
View File

@@ -1,5 +1,7 @@
set -xe
git lfs install
# add the workspace to the codeql search path
mkdir -p /home/vscode/.config/codeql
echo "--search-path /workspaces/codeql" > /home/vscode/.config/codeql/config

17
cpp/downgrades/3d35dd6b50edfc540c14c6757e0c7b3c5b7b04dd/exprs.ql Normal file
View File

@@ -0,0 +1,17 @@
class Expr extends @expr {
string toString() { none() }
}
class Location extends @location_expr {
string toString() { none() }
}
predicate isExprWithNewBuiltin(Expr expr) {
exists(int kind | exprs(expr, kind, _) | 364 <= kind and kind <= 384)
}
from Expr expr, int kind, int kind_new, Location location
where
exprs(expr, kind, location) and
if isExprWithNewBuiltin(expr) then kind_new = 1 else kind_new = kind
select expr, kind_new, location

2289
cpp/downgrades/3d35dd6b50edfc540c14c6757e0c7b3c5b7b04dd/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2251
cpp/downgrades/3d35dd6b50edfc540c14c6757e0c7b3c5b7b04dd/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

3
cpp/downgrades/3d35dd6b50edfc540c14c6757e0c7b3c5b7b04dd/upgrade.properties Normal file
View File

@@ -0,0 +1,3 @@
description: Add new builtin operations
compatibility: partial
exprs.rel: run exprs.qlo

12
cpp/ql/lib/CHANGELOG.md
View File

@@ -1,3 +1,15 @@
## 1.2.0
### New Features
* The syntax for models-as-data rows has been extended to make it easier to select sources, sinks, and summaries that involve templated functions and classes. Additionally, the syntax has also been extended to make it easier to specify models with arbitrary levels of indirection. See `dataflow/ExternalFlow.qll` for the updated documentation and specification for the model format.
* It is now possible to extend the classes `AllocationFunction` and `DeallocationFunction` via data extensions. Extensions of these classes should be added to the `lib/ext/allocation` and `lib/ext/deallocation` directories respectively.
### Minor Analysis Improvements
* The queries "Potential double free" (`cpp/double-free`) and "Potential use after free" (`cpp/use-after-free`) now produce fewer false positives.
* The "Guards" library (`semmle.code.cpp.controlflow.Guards`) now also infers guards from calls to the builtin operation `__builtin_expect`. As a result, some queries may produce fewer false positives.
## 1.1.1
No user-facing changes.

4
cpp/ql/lib/change-notes/2024-06-10-builtin-expect.md
View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The "Guards" library (`semmle.code.cpp.controlflow.Guards`) now also infers guards from calls to the builtin operation `__builtin_expect`. As a result, some queries may produce fewer false positives.

4
cpp/ql/lib/change-notes/2024-06-13-double-free.md
View File

@@ -1,4 +0,0 @@
---
category: minorAnalysis
---
* The queries "Potential double free" (`cpp/double-free`) and "Potential use after free" (`cpp/use-after-free`) now produce fewer false positives.

4
cpp/ql/lib/change-notes/2024-06-20-extensible-allocation-deallocation.md
View File

@@ -1,4 +0,0 @@
---
category: feature
---
* It is now possible to extend the classes `AllocationFunction` and `DeallocationFunction` via data extensions. Extensions of these classes should be added to the `lib/ext/allocation` and `lib/ext/deallocation` directories respectively.

4
cpp/ql/lib/change-notes/2024-07-10-newarrayexpr-arraysize.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: feature
---
* The class `NewArrayExpr` adds a predicate `getArraySize()` to allow a more convenient way to access the static size of the array when the extent is missing.

4
cpp/ql/lib/change-notes/2024-07-11-additional-builtin-support.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: feature
---
* Added subclasses of `BuiltInOperations` for `__builtin_has_attribute`, `__builtin_is_corresponding_member`, `__builtin_is_pointer_interconvertible_with_class`, `__is_assignable_no_precondition_check`, `__is_bounded_array`, `__is_convertible`, `__is_corresponding_member`, `__is_nothrow_convertible`, `__is_pointer_interconvertible_with_class`, `__is_referenceable`, `__is_same_as`, `__is_trivially_copy_assignable`, `__is_unbounded_array`, `__is_valid_winrt_type`, `_is_win_class`, `__is_win_interface`, `__reference_binds_to_temporary`, `__reference_constructs_from_temporary`, and `__reference_converts_from_temporary`.

11
cpp/ql/lib/change-notes/released/1.2.0.md Normal file
View File

@@ -0,0 +1,11 @@
## 1.2.0
### New Features
* The syntax for models-as-data rows has been extended to make it easier to select sources, sinks, and summaries that involve templated functions and classes. Additionally, the syntax has also been extended to make it easier to specify models with arbitrary levels of indirection. See `dataflow/ExternalFlow.qll` for the updated documentation and specification for the model format.
* It is now possible to extend the classes `AllocationFunction` and `DeallocationFunction` via data extensions. Extensions of these classes should be added to the `lib/ext/allocation` and `lib/ext/deallocation` directories respectively.
### Minor Analysis Improvements
* The queries "Potential double free" (`cpp/double-free`) and "Potential use after free" (`cpp/use-after-free`) now produce fewer false positives.
* The "Guards" library (`semmle.code.cpp.controlflow.Guards`) now also infers guards from calls to the builtin operation `__builtin_expect`. As a result, some queries may produce fewer false positives.

2
cpp/ql/lib/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.1.1
lastReleaseVersion: 1.2.0

1
cpp/ql/lib/ext/Boost.Asio.model.yml
View File

@@ -1,4 +1,3 @@
extensions:
# partial model of the Boost::Asio network library
extensions:
- addsTo:

14
cpp/ql/lib/ext/bsl.array.model.yml Normal file
View File

@@ -0,0 +1,14 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["bsl", "array", True, "at", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "array", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "array", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "array", True, "data", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "array", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "array", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "array", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "array", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "array", True, "back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]

73
cpp/ql/lib/ext/bsl.deque.model.yml Normal file
View File

@@ -0,0 +1,73 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["bsl", "deque<T,Allocator>", True, "assign", "(size_type,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "assign<InputIt>", "(InputIt,InputIt)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "at", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "deque", "(const deque &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "deque", "(deque &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@3]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@4]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[*@5]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "emplace_front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "deque", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque<T,Allocator>", True, "deque", "(const deque &,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque<T,Allocator>", True, "deque", "(deque &&,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque<T,Allocator>", True, "deque", "(size_type,const T &,const Allocator &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque<T,Allocator>", True, "deque<InputIterator>", "(InputIterator,InputIterator,const Allocator &)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "deque<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]

56
cpp/ql/lib/ext/bsl.forward_list.model.yml Normal file
View File

@@ -0,0 +1,56 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["bsl", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,size_type,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list<T,Allocator>", True, "assign", "(size_type,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "assign<InputIt>", "(InputIt,InputIt)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@3]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@4]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[*@5]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_after", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "forward_list", True, "emplace_front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "forward_list", True, "forward_list", "(const forward_list &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "forward_list", "(forward_list &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list<T,Allocator>", True, "forward_list", "(const forward_list &,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list<T,Allocator>", True, "forward_list", "(forward_list &&,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list<T,Allocator>", True, "forward_list", "(InputIterator,InputIterator,const Allocator &)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list<T,Allocator>", True, "forward_list", "(size_type,const T &,const Allocator &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,const T &)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,T &&)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,T &&)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "forward_list<T>", True, "insert_after", "(const_iterator,T &&)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]

71
cpp/ql/lib/ext/bsl.list.model.yml Normal file
View File

@@ -0,0 +1,71 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["bsl", "list<T,Allocator>", True, "assign", "(size_type,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "assign<InputIt>", "(InputIt,InputIt)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "emplace_front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "list", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list", True, "list", "(const list &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "list", "(list &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list<T,Allocator>", True, "list", "(const list &,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list<T,Allocator>", True, "list", "(list &&,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list<T,Allocator>", True, "list", "(size_type,const T &,const Allocator &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list<T,Allocator>", True, "list<InputIterator>", "(InputIterator,InputIterator,const Allocator &)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "list<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]

60
cpp/ql/lib/ext/bsl.vector.model.yml Normal file
View File

@@ -0,0 +1,60 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["bsl", "vector<T,Allocator>", True, "assign", "(size_type,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "assign<InputIt>", "(InputIt,InputIt)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "at", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "data", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@3]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@4]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[*@5]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "emplace_back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["bsl", "vector", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector", True, "vector", "(const vector &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector", True, "vector", "(vector &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector<T,Allocator>", True, "vector", "(const vector &,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector<T,Allocator>", True, "vector", "(size_type,const T &,const Allocator &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector<T,Allocator>", True, "vector", "(vector &&,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector<T,Allocator>", True, "vector<InputIterator>", "(InputIterator,InputIterator,const Allocator &)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["bsl", "vector<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]

14
cpp/ql/lib/ext/std.array.model.yml Normal file
View File

@@ -0,0 +1,14 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["std", "array", True, "at", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "array", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "array", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "array", True, "data", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "array", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "array", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "array", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "array", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "array", True, "back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]

73
cpp/ql/lib/ext/std.deque.model.yml Normal file
View File

@@ -0,0 +1,73 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["std", "deque<T,Allocator>", True, "assign", "(size_type,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "assign<InputIt>", "(InputIt,InputIt)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "at", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "deque", "(const deque &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "deque", "(deque &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@3]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@4]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[*@5]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "emplace_front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "deque", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque<T,Allocator>", True, "deque", "(const deque &,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque<T,Allocator>", True, "deque", "(deque &&,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque<T,Allocator>", True, "deque", "(size_type,const T &,const Allocator &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque<T,Allocator>", True, "deque<InputIterator>", "(InputIterator,InputIterator,const Allocator &)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "deque<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]

56
cpp/ql/lib/ext/std.forward_list.model.yml Normal file
View File

@@ -0,0 +1,56 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["std", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,size_type,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list<T,Allocator>", True, "assign", "(size_type,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "assign<InputIt>", "(InputIt,InputIt)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@3]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@4]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[*@5]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_after", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["std", "forward_list", True, "emplace_front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "forward_list", True, "forward_list", "(const forward_list &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "forward_list", "(forward_list &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "insert_after<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list<T,Allocator>", True, "forward_list", "(const forward_list &,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list<T,Allocator>", True, "forward_list", "(forward_list &&,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list<T,Allocator>", True, "forward_list", "(InputIterator,InputIterator,const Allocator &)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list<T,Allocator>", True, "forward_list", "(size_type,const T &,const Allocator &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,const T &)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,T &&)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,T &&)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "forward_list<T>", True, "insert_after", "(const_iterator,T &&)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]

11
cpp/ql/lib/ext/std.iterator.model.yml Normal file
View File

@@ -0,0 +1,11 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["std", "iterator", True, "operator*", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "iterator", True, "operator->", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "iterator", True, "iterator", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["__gnu_cxx", "__normal_iterator", True, "operator*", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["__gnu_cxx", "__normal_iterator", True, "operator->", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["__gnu_cxx", "__normal_iterator", True, "__normal_iterator", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]

71
cpp/ql/lib/ext/std.list.model.yml Normal file
View File

@@ -0,0 +1,71 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["std", "list<T,Allocator>", True, "assign", "(size_type,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "assign<InputIt>", "(InputIt,InputIt)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@3]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@4]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[*@5]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "emplace", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "emplace_front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "list", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "list", "(const list &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "list", "(list &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "push_front", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list<T,Allocator>", True, "list", "(const list &,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list<T,Allocator>", True, "list", "(list &&,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list<T,Allocator>", True, "list", "(size_type,const T &,const Allocator &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list<T,Allocator>", True, "list<InputIterator>", "(InputIterator,InputIterator,const Allocator &)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "list<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]

60
cpp/ql/lib/ext/std.vector.model.yml Normal file
View File

@@ -0,0 +1,60 @@
extensions:
- addsTo:
pack: codeql/cpp-all
extensible: summaryModel
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
- ["std", "vector<T,Allocator>", True, "assign", "(size_type,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "assign<InputIt>", "(InputIt,InputIt)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "at", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "begin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "cbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "data", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@3]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@4]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[*@5]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@0]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@1]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@2]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@3]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@3]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@4]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@4]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@5]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[*@5]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "emplace_back", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "front", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "insert<InputIt>", "(const_iterator,InputIt,InputIt)", "", "Argument[1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "operator=", "", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "operator[]", "", "", "Argument[-1].Element[@]", "ReturnValue[*@]", "value", "manual"]
- ["std", "vector", True, "push_back", "", "", "Argument[*@0]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "rbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "rcbegin", "", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector", True, "vector", "(const vector &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector", True, "vector", "(vector &&)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector<T,Allocator>", True, "vector", "(const vector &,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector<T,Allocator>", True, "vector", "(size_type,const T &,const Allocator &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector<T,Allocator>", True, "vector", "(vector &&,const Allocator &)", "", "Argument[*0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector<T,Allocator>", True, "vector<InputIterator>", "(InputIterator,InputIterator,const Allocator &)", "", "Argument[0].Element[@]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[*@2]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,size_type,const T &)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "Argument[-1].Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[*@1]", "ReturnValue.Element[@]", "value", "manual"]
- ["std", "vector<T>", True, "insert", "(const_iterator,T &&)", "", "Argument[-1].Element[@]", "ReturnValue.Element[@]", "value", "manual"]

2
cpp/ql/lib/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/cpp-all
version: 1.1.2-dev
version: 1.2.1-dev
groups: cpp
dbscheme: semmlecode.cpp.dbscheme
extractor: cpp

11
cpp/ql/lib/semmle/code/cpp/controlflow/IRGuards.qll
View File

@@ -59,8 +59,7 @@ class MatchValue extends AbstractValue, TMatchValue {
}
/**
* A Boolean condition in the AST that guards one or more basic blocks. This includes
* operands of logical operators but not switch statements.
* A Boolean condition in the AST that guards one or more basic blocks.
*/
cached
class GuardCondition extends Expr {
@@ -366,10 +365,10 @@ private predicate nonExcludedIRAndBasicBlock(IRBlock irb, BasicBlock controlled)
}
/**
* A Boolean condition in the IR that guards one or more basic blocks. This includes
* operands of logical operators but not switch statements. Note that `&&` and `||`
* don't have an explicit representation in the IR, and therefore will not appear as
* IRGuardConditions.
* A Boolean condition in the IR that guards one or more basic blocks.
*
* Note that `&&` and `||` don't have an explicit representation in the IR,
* and therefore will not appear as IRGuardConditions.
*/
cached
class IRGuardCondition extends Instruction {

441
cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll
View File

@@ -14,16 +14,22 @@
* The interpretation of a row is similar to API-graphs with a left-to-right
* reading.
* 1. The `namespace` column selects a namespace.
* 2. The `type` column selects a type within that namespace.
* 2. The `type` column selects a type within that namespace. This column can
* introduce template names that can be mentioned in the `signature` column.
* For example, `vector<T,Allocator>` introduces the template names `T` and
* `Allocator`.
* 3. The `subtypes` is a boolean that indicates whether to jump to an
* arbitrary subtype of that type. Set this to `false` if leaving the `type`
* blank (for example, a free function).
* 4. The `name` column optionally selects a specific named member of the type.
* Like the `type` column, this column can introduce template names that can
* be mentioned in the `signature` column. For example, `insert<InputIt>`
* introduces the template name `InputIt`.
* 5. The `signature` column optionally restricts the named member. If
* `signature` is blank then no such filtering is done. The format of the
* signature is a comma-separated list of types enclosed in parentheses. The
* types can be short names or fully qualified names (mixing these two options
* is not allowed within a single signature).
* types must be stripped of template names. That is, write `const vector &`
* instead of `const vector<T> &`.
* 6. The `ext` column specifies additional API-graph-like edges. Currently
* there is only one valid value: "".
* 7. The `input` column specifies how data enters the element selected by the
@@ -44,6 +50,9 @@
* One or more "*" can be added as an argument to indicate indirection, for
* example, "ReturnValue[*]" indicates the first indirection of the return
* value.
* The special symbol `@` can be used to specify an arbitrary (but fixed)
* number of indirections. For example, the `input` column `Argument[*@0]`
* indicates one or more indirections of the 0th argument.
*
* An `output` can be either:
* - "": Selects a read of a selected field.
@@ -65,6 +74,17 @@
* One or more "*" can be added as an argument to indicate indirection, for
* example, "ReturnValue[*]" indicates the first indirection of the return
* value.
* The special symbol `@` can be used to specify an arbitrary (but fixed)
* number of indirections. For example, the `output` column
* `ReturnValue[*@0]` indicates one or more indirections of the return
* value.
* Note: The symbol `@` only ever takes a single value across a row. Thus,
* the (`input`, `output`) pair `("Argument[*@0]", "ReturnValue[@]")`
* represents:
* - flow from the _first_ indirection of the 0th argument to the return
* value, and
* - flow from the _second_ indirection of the 0th argument to the first
* indirection of the return value, etc.
* 8. The `kind` column is a tag that can be referenced from QL to determine to
* which classes the interpreted elements should be added. For example, for
* sources "remote" indicates a default remote flow source, and for summaries
@@ -74,6 +94,8 @@
import cpp
private import new.DataFlow
private import semmle.code.cpp.ir.dataflow.internal.DataFlowPrivate as Private
private import semmle.code.cpp.ir.dataflow.internal.DataFlowUtil
private import internal.FlowSummaryImpl
private import internal.FlowSummaryImpl::Public
private import internal.FlowSummaryImpl::Private
@@ -166,8 +188,12 @@ predicate sinkModel(
Extensions::sinkModel(namespace, type, subtypes, name, signature, ext, input, kind, provenance, _)
}
/** Holds if a summary model exists for the given parameters. */
predicate summaryModel(
/**
* Holds if a summary model exists for the given parameters.
*
* This predicate does not expand `@` to `*`s.
*/
private predicate summaryModel0(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
string input, string output, string kind, string provenance
) {
@@ -190,6 +216,33 @@ predicate summaryModel(
provenance, _)
}
/**
* Holds if `input` is `input0`, but with all occurrences of `@` replaced
* by `n` repetitions of `*` (and similarly for `output` and `output0`).
*/
bindingset[input0, output0, n]
pragma[inline_late]
private predicate expandInputAndOutput(
string input0, string input, string output0, string output, int n
) {
input = input0.replaceAll("@", repeatStars(n)) and
output = output0.replaceAll("@", repeatStars(n))
}
/**
* Holds if a summary model exists for the given parameters.
*/
predicate summaryModel(
string namespace, string type, boolean subtypes, string name, string signature, string ext,
string input, string output, string kind, string provenance
) {
exists(string input0, string output0 |
summaryModel0(namespace, type, subtypes, name, signature, ext, input0, output0, kind, provenance) and
expandInputAndOutput(input0, input, output0, output,
[0 .. Private::getMaxElementContentIndirectionIndex() - 1])
)
}
private predicate relevantNamespace(string namespace) {
sourceModel(namespace, _, _, _, _, _, _, _, _) or
sinkModel(namespace, _, _, _, _, _, _, _, _) or
@@ -367,16 +420,155 @@ private predicate elementSpec(
summaryModel(namespace, type, subtypes, name, signature, ext, _, _, _, _)
}
private string paramsStringPart(Function c, int i) {
i = -1 and result = "(" and exists(c)
or
exists(int n, string p | c.getParameter(n).getType().toString() = p |
i = 2 * n and result = p
or
i = 2 * n - 1 and result = "," and n != 0
/** Gets the fully templated version of `f`. */
private Function getFullyTemplatedMemberFunction(Function f) {
not f.isFromUninstantiatedTemplate(_) and
exists(Class c, Class templateClass, int i |
c.isConstructedFrom(templateClass) and
f = c.getAMember(i) and
result = templateClass.getCanonicalMember(i)
)
}
/**
* Gets the type name of the `n`'th parameter of `f` without any template
* arguments.
*/
bindingset[f]
pragma[inline_late]
string getParameterTypeWithoutTemplateArguments(Function f, int n) {
exists(string s, string base, string specifiers |
s = f.getParameter(n).getType().getName() and
parseAngles(s, base, _, specifiers) and
result = base + specifiers
)
}
/**
* Normalize the `n`'th parameter of `f` by replacing template names
* with `func:N` (where `N` is the index of the template).
*/
private string getTypeNameWithoutFunctionTemplates(Function f, int n, int remaining) {
exists(Function templateFunction |
templateFunction = getFullyTemplatedMemberFunction(f) and
remaining = templateFunction.getNumberOfTemplateArguments() and
result = getParameterTypeWithoutTemplateArguments(templateFunction, n)
)
or
i = 2 * c.getNumberOfParameters() and result = ")"
exists(string mid, TemplateParameter tp, Function templateFunction |
mid = getTypeNameWithoutFunctionTemplates(f, n, remaining + 1) and
templateFunction = getFullyTemplatedMemberFunction(f) and
tp = templateFunction.getTemplateArgument(remaining) and
result = mid.replaceAll(tp.getName(), "func:" + remaining.toString())
)
}
/**
* Normalize the `n`'th parameter of `f` by replacing template names
* with `class:N` (where `N` is the index of the template).
*/
private string getTypeNameWithoutClassTemplates(Function f, int n, int remaining) {
exists(Class template |
f.getDeclaringType().isConstructedFrom(template) and
remaining = template.getNumberOfTemplateArguments() and
result = getTypeNameWithoutFunctionTemplates(f, n, 0)
)
or
exists(string mid, TemplateParameter tp, Class template |
mid = getTypeNameWithoutClassTemplates(f, n, remaining + 1) and
f.getDeclaringType().isConstructedFrom(template) and
tp = template.getTemplateArgument(remaining) and
result = mid.replaceAll(tp.getName(), "class:" + remaining.toString())
)
}
/** Gets the string representation of the `i`'th parameter of `c`. */
private string getParameterTypeName(Function c, int i) {
result = getTypeNameWithoutClassTemplates(c, i, 0)
}
/** Splits `s` by `,` and gets the `i`'th element. */
bindingset[s]
pragma[inline_late]
private string getAtIndex(string s, int i) {
result = s.splitAt(",", i) and
// when `s` is `""` and `i` is `0` we get `result = ""` which we don't want.
not (s = "" and i = 0)
}
/**
* Normalizes `partiallyNormalizedSignature` by replacing the `remaining`
* number of template arguments in `partiallyNormalizedSignature` with their
* index in `typeArgs`.
*/
private string getSignatureWithoutClassTemplateNames(
string partiallyNormalizedSignature, string typeArgs, string nameArgs, int remaining
) {
elementSpecWithArguments0(_, _, _, partiallyNormalizedSignature, typeArgs, nameArgs) and
remaining = count(partiallyNormalizedSignature.indexOf(",")) + 1 and
result = partiallyNormalizedSignature
or
exists(string mid |
mid =
getSignatureWithoutClassTemplateNames(partiallyNormalizedSignature, typeArgs, nameArgs,
remaining + 1)
|
exists(string typeArg |
typeArg = getAtIndex(typeArgs, remaining) and
result = mid.replaceAll(typeArg, "class:" + remaining.toString())
)
or
// Make sure `remaining` is properly bound
remaining = [0 .. count(partiallyNormalizedSignature.indexOf(",")) + 1] and
not exists(getAtIndex(typeArgs, remaining)) and
result = mid
)
}
/**
* Normalizes `partiallyNormalizedSignature` by replacing:
* - _All_ the template arguments in `partiallyNormalizedSignature` that refer to
* template parameters in `typeArgs` with their index in `typeArgs`, and
* - The `remaining` number of template arguments in `partiallyNormalizedSignature`
* with their index in `nameArgs`.
*/
private string getSignatureWithoutFunctionTemplateNames(
string partiallyNormalizedSignature, string typeArgs, string nameArgs, int remaining
) {
remaining = count(partiallyNormalizedSignature.indexOf(",")) + 1 and
result =
getSignatureWithoutClassTemplateNames(partiallyNormalizedSignature, typeArgs, nameArgs, 0)
or
exists(string mid |
mid =
getSignatureWithoutFunctionTemplateNames(partiallyNormalizedSignature, typeArgs, nameArgs,
remaining + 1)
|
exists(string nameArg |
nameArg = getAtIndex(nameArgs, remaining) and
result = mid.replaceAll(nameArg, "func:" + remaining.toString())
)
or
// Make sure `remaining` is properly bound
remaining = [0 .. count(partiallyNormalizedSignature.indexOf(",")) + 1] and
not exists(getAtIndex(nameArgs, remaining)) and
result = mid
)
}
private string paramsStringPart(Function c, int i) {
not c.isFromUninstantiatedTemplate(_) and
(
i = -1 and result = "(" and exists(c)
or
exists(int n, string p | getParameterTypeName(c, n) = p |
i = 2 * n and result = p
or
i = 2 * n - 1 and result = "," and n != 0
)
or
i = 2 * c.getNumberOfParameters() and result = ")"
)
}
/**
@@ -396,6 +588,193 @@ private predicate matchesSignature(Function func, string signature) {
paramsString(func) = signature
}
/**
* Holds if `elementSpec(_, type, _, name, signature, _)` holds and
* - `typeArgs` represents the named template parameters supplied to `type`, and
* - `nameArgs` represents the named template parameters supplied to `name`, and
* - `normalizedSignature` is `signature`, except with
* - template parameter names replaced by `func:i` if the template name is
* the `i`'th entry in `nameArgs`, and
* - template parameter names replaced by `class:i` if the template name is
* the `i`'th entry in `typeArgs`.
*
* In other words, the string `normalizedSignature` represents a "normalized"
* signature with no mention of any free template parameters.
*
* For example, consider a summary row such as:
* ```
* elementSpec(_, "MyClass<B, C>", _, myFunc<A>, "(const A &,int,C,B *)", _)
* ```
* In this case, `normalizedSignature` will be `"(const func:0 &,int,class:1,class:0 *)"`.
*/
private predicate elementSpecWithArguments(
string signature, string type, string name, string normalizedSignature, string typeArgs,
string nameArgs
) {
exists(string signatureWithoutParens |
elementSpecWithArguments0(signature, type, name, signatureWithoutParens, typeArgs, nameArgs) and
normalizedSignature =
getSignatureWithoutFunctionTemplateNames(signatureWithoutParens, typeArgs, nameArgs, 0)
)
}
/** Gets the `n`'th normalized signature parameter for the function `name` in class `type`. */
private string getSignatureParameterName(string signature, string type, string name, int n) {
exists(string normalizedSignature |
elementSpecWithArguments(signature, type, name, normalizedSignature, _, _) and
result = getAtIndex(normalizedSignature, n)
)
}
/**
* Holds if the suffix containing the entries in `signature` starting at entry
* `i` matches the suffix containing the parameters of `func` starting at entry `i`.
*
* For example, consider the signature `(int,bool,char)` and a function:
* ```
* void f(int a, bool b, char c);
* ```
* 1. The predicate holds for `i = 2` because the suffix containing all the entries
* in `signature` starting at `2` is `char`, and suffix containing all the parameters
* of `func` starting at `2` is `char`.
* 2. The predicate holds for `i = 1` because the suffix containing all the entries
* in `signature` starting at `1` is `bool,char`, and the suffix containing all the
* parameters of `func` starting at `1` is `bool, char`.
* 3. The predicate holds for `i = 0` because the suffix containing all the entries
* in `signature` starting at `0` is `int,bool,char` and the suffix containing all
* the parameters of `func` starting at `0` is `int, bool, char`.
*
* When `paramsString(func)[i]` is `class:n` then the signature name is
* compared with the `n`'th name in `type`, and when `paramsString(func)[i]`
* is `func:n` then the signature name is compared with the `n`'th name
* in `name`.
*/
private predicate signatureMatches(Function func, string signature, string type, string name, int i) {
exists(string s |
s = getSignatureParameterName(signature, type, name, i) and
s = getParameterTypeName(func, i)
) and
if exists(getParameterTypeName(func, i + 1))
then signatureMatches(func, signature, type, name, i + 1)
else i = count(signature.indexOf(","))
}
/**
* Internal: Do not use.
*
* This module only exists to expose internal predicates for testing purposes.
*/
module ExternalFlowDebug {
/**
* INTERNAL: Do not use.
*
* Exposed for testing purposes.
*/
predicate signatureMatches_debug = signatureMatches/5;
/**
* INTERNAL: Do not use.
*
* Exposed for testing purposes.
*/
predicate getSignatureParameterName_debug = getSignatureParameterName/4;
/**
* INTERNAL: Do not use.
*
* Exposed for testing purposes.
*/
predicate getParameterTypeName_debug = getParameterTypeName/2;
}
/**
* Holds if `s` can be broken into a string of the form
* `beforeAngles<betweenAngles>`,
* or `s = beforeAngles` where `beforeAngles` does not have any brackets.
*/
bindingset[s]
pragma[inline_late]
private predicate parseAngles(
string s, string beforeAngles, string betweenAngles, string afterAngles
) {
beforeAngles = s.regexpCapture("([^<]+)(?:<([^>]+)>(.*))?", 1) and
(
betweenAngles = s.regexpCapture("([^<]+)(?:<([^>]+)>(.*))?", 2) and
afterAngles = s.regexpCapture("([^<]+)(?:<([^>]+)>(.*))?", 3)
or
not exists(s.regexpCapture("([^<]+)(?:<([^>]+)>(.*))?", 2)) and
betweenAngles = "" and
afterAngles = ""
)
}
/** Holds if `s` can be broken into a string of the form `(betweenParens)`. */
bindingset[s]
pragma[inline_late]
private predicate parseParens(string s, string betweenParens) { s = "(" + betweenParens + ")" }
/**
* Holds if `elementSpec(_, type, _, name, signature, _)` and:
* - `type` introduces template parameters `typeArgs`, and
* - `name` introduces template parameters `nameArgs`, and
* - `signatureWithoutParens` equals `signature`, but with the surrounding
* parentheses removed.
*/
private predicate elementSpecWithArguments0(
string signature, string type, string name, string signatureWithoutParens, string typeArgs,
string nameArgs
) {
elementSpec(_, type, _, name, signature, _) and
parseAngles(name, _, nameArgs, "") and
(
type = "" and typeArgs = ""
or
parseAngles(type, _, typeArgs, "")
) and
parseParens(signature, signatureWithoutParens)
}
/**
* Holds if `elementSpec(namespace, type, subtypes, name, signature, _)` and
* `method`'s signature matches `signature`.
*
* `signature` may contain template parameter names that are bound by `type` and `name`.
*/
pragma[nomagic]
private predicate elementSpecMatchesSignature(
Function method, string namespace, string type, boolean subtypes, string name, string signature
) {
elementSpec(namespace, pragma[only_bind_into](type), subtypes, pragma[only_bind_into](name),
pragma[only_bind_into](signature), _) and
signatureMatches(method, signature, type, name, 0)
}
/**
* Holds if `classWithMethod` has `method` named `name` (excluding any
* template parameters).
*/
bindingset[name]
pragma[inline_late]
private predicate hasClassAndName(Class classWithMethod, Function method, string name) {
exists(string nameWithoutArgs |
parseAngles(name, nameWithoutArgs, _, "") and
classWithMethod = method.getClassAndName(nameWithoutArgs)
)
}
/**
* Holds if `namedClass` is in namespace `namespace` and has
* name `type` (excluding any template parameters).
*/
bindingset[type, namespace]
pragma[inline_late]
private predicate hasQualifiedName(Class namedClass, string namespace, string type) {
exists(string typeWithoutArgs |
parseAngles(type, typeWithoutArgs, _, "") and
namedClass.hasQualifiedName(namespace, typeWithoutArgs)
)
}
/**
* Gets the element in module `namespace` that satisfies the following properties:
* 1. If the element is a member of a class-like type, then the class-like type has name `type`
@@ -410,8 +789,8 @@ pragma[nomagic]
private Element interpretElement0(
string namespace, string type, boolean subtypes, string name, string signature
) {
elementSpec(namespace, type, subtypes, name, signature, _) and
(
elementSpec(namespace, type, subtypes, name, signature, _) and
// Non-member functions
exists(Function func |
func.hasQualifiedName(namespace, name) and
@@ -423,21 +802,28 @@ private Element interpretElement0(
)
or
// Member functions
exists(Class namedClass, Class classWithMethod, Function method |
classWithMethod = method.getClassAndName(name) and
namedClass.hasQualifiedName(namespace, type) and
matchesSignature(method, signature) and
result = method
|
// member declared in the named type or a subtype of it
subtypes = true and
classWithMethod = namedClass.getADerivedClass*()
or
// member declared directly in the named type
subtypes = false and
classWithMethod = namedClass
exists(Class namedClass, Class classWithMethod |
(
elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature) and
hasClassAndName(classWithMethod, result, name)
or
signature = "" and
elementSpec(namespace, type, subtypes, name, "", _) and
hasClassAndName(classWithMethod, result, name)
) and
hasQualifiedName(namedClass, namespace, type) and
(
// member declared in the named type or a subtype of it
subtypes = true and
classWithMethod = namedClass.getADerivedClass*()
or
// member declared directly in the named type
subtypes = false and
classWithMethod = namedClass
)
)
or
elementSpec(namespace, type, subtypes, name, signature, _) and
// Member variables
signature = "" and
exists(Class namedClass, Class classWithMember, MemberVariable member |
@@ -456,6 +842,7 @@ private Element interpretElement0(
)
or
// Global or namespace variables
elementSpec(namespace, type, subtypes, name, signature, _) and
signature = "" and
type = "" and
subtypes = false and

29
cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowSummaryImpl.qll
View File

@@ -35,16 +35,22 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
result = "Field" and
arg = repeatStars(c.getIndirectionIndex() - 1) + c.getField().getName()
)
or
exists(ElementContent ec |
cs.isSingleton(ec) and
result = "Element" and
arg = repeatStars(ec.getIndirectionIndex() - 1)
)
}
string encodeWithoutContent(ContentSet c, string arg) {
// used for type tracking, not currently used in C/C++.
result = "WithoutContent" + c and arg = ""
none()
}
string encodeWithContent(ContentSet c, string arg) {
// used for type tracking, not currently used in C/C++.
result = "WithContent" + c and arg = ""
none()
}
/**
@@ -79,25 +85,6 @@ module Input implements InputSig<Location, DataFlowImplSpecific::CppDataFlow> {
token.getName() = "Parameter" and
result = decodePosition(token.getAnArgument())
}
bindingset[token]
ContentSet decodeUnknownContent(AccessPath::AccessPathTokenBase token) {
// field content (no indirection support)
exists(FieldContent c |
result.isSingleton(c) and
token.getName() = c.getField().getName() and
not exists(token.getArgumentList()) and
c.getIndirectionIndex() = 1
)
or
// field content (with indirection support)
exists(FieldContent c |
result.isSingleton(c) and
token.getName() = c.getField().getName() and
// FieldContent indices have 0 for the address, 1 for content, so we need to subtract one.
token.getAnArgument() = repeatStars(c.getIndirectionIndex() - 1)
)
}
}
private import Make<Location, DataFlowImplSpecific::CppDataFlow, Input> as Impl

336
cpp/ql/lib/semmle/code/cpp/exprs/BuiltInOperations.qll
View File

@@ -383,6 +383,37 @@ class BuiltInOperationIsConvertibleTo extends BuiltInOperation, @isconvtoexpr {
override string getAPrimaryQlClass() { result = "BuiltInOperationIsConvertibleTo" }
}
/**
* A C++ `__is_convertible` built-in operation (used by some implementations
* of the `<type_traits>` header).
*
* Returns `true` if the first type can be converted to the second type.
* ```
* bool v = __is_convertible(MyType, OtherType);
* ```
*/
class BuiltInOperationIsConvertible extends BuiltInOperation, @isconvertible {
override string toString() { result = "__is_convertible" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsConvertible" }
}
/**
* A C++ `__is_nothrow_convertible` built-in operation (used by some implementations
* of the `<type_traits>` header).
*
* Returns `true` if the first type can be converted to the second type and the
* conversion operator has an empty exception specification.
* ```
* bool v = __is_nothrow_convertible(MyType, OtherType);
* ```
*/
class BuiltInOperationIsNothrowConvertible extends BuiltInOperation, @isnothrowconvertible {
override string toString() { result = "__is_nothrow_convertible" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsNothrowConvertible" }
}
/**
* A C++ `__is_empty` built-in operation (used by some implementations of the
* `<type_traits>` header).
@@ -647,8 +678,7 @@ class BuiltInOperationIsTriviallyAssignable extends BuiltInOperation, @istrivial
* The `__is_nothrow_assignable` built-in operation (used by some
* implementations of the `<type_traits>` header).
*
* Returns true if there exists a `C::operator =(const D& d) nothrow`
* assignment operator (i.e, with an empty exception specification).
* Returns true if there exists an assignment operator with an empty exception specification.
* ```
* bool v = __is_nothrow_assignable(MyType1, MyType2);
* ```
@@ -663,8 +693,7 @@ class BuiltInOperationIsNothrowAssignable extends BuiltInOperation, @isnothrowas
* The `__is_assignable` built-in operation (used by some implementations
* of the `<type_traits>` header).
*
* Returns true if there exists a `C::operator =(const D& d)` assignment
* operator.
* Returns true if there exists an assignment operator.
* ```
* bool v = __is_assignable(MyType1, MyType2);
* ```
@@ -675,6 +704,25 @@ class BuiltInOperationIsAssignable extends BuiltInOperation, @isassignable {
override string getAPrimaryQlClass() { result = "BuiltInOperationIsAssignable" }
}
/**
* The `__is_assignable_no_precondition_check` built-in operation (used by some
* implementations of the `<type_traits>` header).
*
* Returns true if there exists an assignment operator.
* ```
* bool v = __is_assignable_no_precondition_check(MyType1, MyType2);
* ```
*/
class BuiltInOperationIsAssignableNoPreconditionCheck extends BuiltInOperation,
@isassignablenopreconditioncheck
{
override string toString() { result = "__is_assignable_no_precondition_check" }
override string getAPrimaryQlClass() {
result = "BuiltInOperationIsAssignableNoPreconditionCheck"
}
}
/**
* The `__is_standard_layout` built-in operation (used by some implementations
* of the `<type_traits>` header).
@@ -708,6 +756,20 @@ class BuiltInOperationIsTriviallyCopyable extends BuiltInOperation, @istrivially
override string getAPrimaryQlClass() { result = "BuiltInOperationIsTriviallyCopyable" }
}
/**
* The `__is_trivially_copy_assignable` built-in operation (used by some
* implementations of the `<type_traits>` header).
*
* Returns `true` if instances of this type can be copied using a trivial
* copy operator.
*/
class BuiltInOperationIsTriviallyCopyAssignable extends BuiltInOperation, @istriviallycopyassignable
{
override string toString() { result = "__is_trivially_copy_assignable" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsTriviallyCopyAssignable" }
}
/**
* The `__is_literal_type` built-in operation (used by some implementations of
* the `<type_traits>` header).
@@ -1062,6 +1124,24 @@ class BuiltInOperationIsSame extends BuiltInOperation, @issame {
override string getAPrimaryQlClass() { result = "BuiltInOperationIsSame" }
}
/**
* A C++ `__is_same_as` built-in operation (used by some implementations of the
* `<type_traits>` header).
*
* Returns `true` if two types are the same.
* ```
* template<typename _Tp, typename _Up>
* struct is_same
* : public integral_constant<bool, __is_same_as(_Tp, _Up)>
* { };
* ```
*/
class BuiltInOperationIsSameAs extends BuiltInOperation, @issameas {
override string toString() { result = "__is_same_as" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsSameAs" }
}
/**
* A C++ `__is_function` built-in operation (used by some implementations of the
* `<type_traits>` header).
@@ -1120,6 +1200,87 @@ class BuiltInOperationIsPointerInterconvertibleBaseOf extends BuiltInOperation,
}
}
/**
* A C++ `__is_pointer_interconvertible_with_class` built-in operation (used
* by some implementations of the `<type_traits>` header).
*
* Returns `true` if a member pointer is pointer-interconvertible with a
* class type.
* ```
* template<typename _Tp, typename _Up>
* constexpr bool is_pointer_interconvertible_with_class(_Up _Tp::*mp) noexcept
* = __is_pointer_interconvertible_with_class(_Tp, mp);
* ```
*/
class BuiltInOperationIsPointerInterconvertibleWithClass extends BuiltInOperation,
@ispointerinterconvertiblewithclass
{
override string toString() { result = "__is_pointer_interconvertible_with_class" }
override string getAPrimaryQlClass() {
result = "BuiltInOperationIsPointerInterconvertibleWithClass"
}
}
/**
* A C++ `__builtin_is_pointer_interconvertible_with_class` built-in operation (used
* by some implementations of the `<type_traits>` header).
*
* Returns `true` if a member pointer is pointer-interconvertible with a class type.
* ```
* template<typename _Tp, typename _Up>
* constexpr bool is_pointer_interconvertible_with_class(_Up _Tp::*mp) noexcept
* = __builtin_is_pointer_interconvertible_with_class(mp);
* ```
*/
class BuiltInOperationBuiltInIsPointerInterconvertible extends BuiltInOperation,
@builtinispointerinterconvertiblewithclass
{
override string toString() { result = "__builtin_is_pointer_interconvertible_with_class" }
override string getAPrimaryQlClass() {
result = "BuiltInOperationBuiltInIsPointerInterconvertible"
}
}
/**
* A C++ `__is_corresponding_member` built-in operation (used
* by some implementations of the `<type_traits>` header).
*
* Returns `true` if two member pointers refer to corresponding
* members in the initial sequences of two class types.
* ```
* template<typename _Tp1, typename _Tp2, typename _Up1, typename _Up2>
* constexpr bool is_corresponding_member(_Up1 _Tp1::*mp1, _Up2 _Tp2::*mp2 ) noexcept
* = __is_corresponding_member(_Tp1, _Tp2, mp1, mp2);
* ```
*/
class BuiltInOperationIsCorrespondingMember extends BuiltInOperation, @iscorrespondingmember {
override string toString() { result = "__is_corresponding_member" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsCorrespondingMember" }
}
/**
* A C++ `__builtin_is_corresponding_member` built-in operation (used
* by some implementations of the `<type_traits>` header).
*
* Returns `true` if two member pointers refer to corresponding
* members in the initial sequences of two class types.
* ```
* template<typename _Tp1, typename _Tp2, typename _Up1, typename _Up2>
* constexpr bool is_corresponding_member(_Up1 _Tp1::*mp1, _Up2 _Tp2::*mp2 ) noexcept
* = __builtin_is_corresponding_member(mp1, mp2);
* ```
*/
class BuiltInOperationBuiltInIsCorrespondingMember extends BuiltInOperation,
@builtiniscorrespondingmember
{
override string toString() { result = "__builtin_is_corresponding_member" }
override string getAPrimaryQlClass() { result = "BuiltInOperationBuiltInIsCorrespondingMember" }
}
/**
* A C++ `__is_array` built-in operation (used by some implementations of the
* `<type_traits>` header).
@@ -1138,6 +1299,42 @@ class BuiltInOperationIsArray extends BuiltInOperation, @isarray {
override string getAPrimaryQlClass() { result = "BuiltInOperationIsArray" }
}
/**
* A C++ `__is_bounded_array` built-in operation (used by some implementations
* of the `<type_traits>` header).
*
* Returns `true` if a type is a bounded array type.
* ```
* template<typename _Tp>
* struct is_bounded_array
* : public integral_constant<bool, __is_bounded_array(_Tp)>
* { };
* ```
*/
class BuiltInOperationIsBoundedArray extends BuiltInOperation, @isboundedarray {
override string toString() { result = "__is_bounded_array" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsBoundedArray" }
}
/**
* A C++ `__is_unbounded_array` built-in operation (used by some implementations
* of the `<type_traits>` header).
*
* Returns `true` if a type is an unbounded array type.
* ```
* template<typename _Tp>
* struct is_bounded_array
* : public integral_constant<bool, __is_unbounded_array(_Tp)>
* { };
* ```
*/
class BuiltInOperationIsUnboundedArray extends BuiltInOperation, @isunboundedarray {
override string toString() { result = "__is_unbounded_array" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsUnboundedArray" }
}
/**
* A C++ `__array_rank` built-in operation (used by some implementations of the
* `<type_traits>` header).
@@ -1554,10 +1751,10 @@ class BuiltInBitCast extends BuiltInOperation, @builtinbitcast {
*
* Returns `true` if a type is a trivial type.
* ```
* template<typename _Tp>
* struct is_trivial
* : public integral_constant<bool, __is_trivial(_Tp)>
* {};
* template<typename _Tp>
* struct is_trivial
* : public integral_constant<bool, __is_trivial(_Tp)>
* {};
* ```
*/
class BuiltInIsTrivial extends BuiltInOperation, @istrivialexpr {
@@ -1565,3 +1762,126 @@ class BuiltInIsTrivial extends BuiltInOperation, @istrivialexpr {
override string getAPrimaryQlClass() { result = "BuiltInIsTrivial" }
}
/**
* A C++ `__reference_constructs_from_temporary` built-in operation
* (used by some implementations of the `<type_traits>` header).
*
* Returns `true` if a reference type `_Tp` is bound to an expression of
* type `_Up` in direct-initialization, and a temporary object is bound.
* ```
* template<typename _Tp, typename _Up>
* struct reference_constructs_from_temporary
* : public integral_constant<bool, __reference_constructs_from_temporary(_Tp, _Up)>
* {};
* ```
*/
class BuiltInOperationReferenceConstructsFromTemporary extends BuiltInOperation,
@referenceconstructsfromtemporary
{
override string toString() { result = "__reference_constructs_from_temporary" }
override string getAPrimaryQlClass() {
result = "BuiltInOperationReferenceConstructsFromTemporary"
}
}
/**
* A C++ `__reference_converts_from_temporary` built-in operation
* (used by some implementations of the `<type_traits>` header).
*
* Returns `true` if a reference type `_Tp` is bound to an expression of
* type `_Up` in copy-initialization, and a temporary object is bound.
* ```
* template<typename _Tp, typename _Up>
* struct reference_converts_from_temporary
* : public integral_constant<bool, __reference_converts_from_temporary(_Tp, _Up)>
* {};
* ```
*/
class BuiltInOperationReferenceCovertsFromTemporary extends BuiltInOperation,
@referenceconvertsfromtemporary
{
override string toString() { result = "__reference_converts_from_temporary" }
override string getAPrimaryQlClass() { result = "BuiltInOperationReferenceCovertsFromTemporary" }
}
/**
* A C++ `__reference_binds_to_temporary` built-in operation (used by some
* implementations of the `<tuple>` header).
*
* Returns `true` if a reference of type `Type1` is bound to an expression of
* type `Type1`, and a temporary object is bound.
* ```
* __reference_binds_to_temporary(Type1, Type2)
*/
class BuiltInOperationReferenceBindsToTemporary extends BuiltInOperation, @referencebindstotemporary
{
override string toString() { result = "__reference_binds_to_temporary" }
override string getAPrimaryQlClass() { result = "BuiltInOperationReferenceBindsToTemporary" }
}
/**
* A C++ `__builtin_has_attribute` built-in operation.
*
* Returns `true` if a type or expression has been declared with the
* specified attribute.
* ```
* __attribute__ ((aligned(8))) int v;
* bool has_attribute = __builtin_has_attribute(v, aligned);
* ```
*/
class BuiltInOperationHasAttribute extends BuiltInOperation, @builtinhasattribute {
override string toString() { result = "__builtin_has_attribute" }
override string getAPrimaryQlClass() { result = "BuiltInOperationHasAttribute" }
}
/**
* A C++ `__is_referenceable` built-in operation.
*
* Returns `true` if a type can be referenced.
* ```
* bool is_referenceable = __is_referenceable(int);
* ```
*/
class BuiltInOperationIsReferenceable extends BuiltInOperation, @isreferenceable {
override string toString() { result = "__is_referenceable" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsReferenceable" }
}
/**
* The `__is_valid_winrt_type` built-in operation. This is a Microsoft extension.
*
* Returns `true` if the type is a valid WinRT type.
*/
class BuiltInOperationIsValidWinRtType extends BuiltInOperation, @isvalidwinrttype {
override string toString() { result = "__is_valid_winrt_type" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsValidWinRtType" }
}
/**
* The `__is_win_class` built-in operation. This is a Microsoft extension.
*
* Returns `true` if the class is a ref class.
*/
class BuiltInOperationIsWinClass extends BuiltInOperation, @iswinclass {
override string toString() { result = "__is_win_class" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsWinClass" }
}
/**
* The `__is_win_class` built-in operation. This is a Microsoft extension.
*
* Returns `true` if the class is an interface class.
*/
class BuiltInOperationIsWinInterface extends BuiltInOperation, @iswininterface {
override string toString() { result = "__is_win_interface" }
override string getAPrimaryQlClass() { result = "BuiltInOperationIsWinInterface" }
}

10
cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll
View File

@@ -949,6 +949,16 @@ class NewArrayExpr extends NewOrNewArrayExpr, @new_array_expr {
* gives nothing, as the 10 is considered part of the type.
*/
Expr getExtent() { result = this.getChild(2) }
/**
* Gets the number of elements in the array, if available.
*
* For example, `new int[]{1,2,3}` has an array size of 3.
*/
int getArraySize() {
result = this.getAllocatedType().(ArrayType).getArraySize() or
result = this.getInitializer().(ArrayAggregateLiteral).getArraySize()
}
}
private class TDeleteOrDeleteArrayExpr = @delete_expr or @delete_array_expr;

39
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
View File

@@ -412,6 +412,8 @@ class ArgumentPosition = Position;
abstract class Position extends TPosition {
abstract string toString();
abstract int getIndirectionIndex();
}
class DirectPosition extends Position, TDirectPosition {
@@ -421,13 +423,15 @@ class DirectPosition extends Position, TDirectPosition {
override string toString() {
index = -1 and
result = "this"
result = "this pointer"
or
index != -1 and
result = index.toString()
}
int getIndex() { result = index }
final override int getIndirectionIndex() { result = 0 }
}
class IndirectionPosition extends Position, TIndirectionPosition {
@@ -438,16 +442,13 @@ class IndirectionPosition extends Position, TIndirectionPosition {
override string toString() {
if argumentIndex = -1
then if indirectionIndex > 0 then result = "this indirection" else result = "this"
else
if indirectionIndex > 0
then result = argumentIndex.toString() + " indirection"
else result = argumentIndex.toString()
then result = repeatStars(indirectionIndex - 1) + "this"
else result = repeatStars(indirectionIndex) + argumentIndex.toString()
}
int getArgumentIndex() { result = argumentIndex }
int getIndirectionIndex() { result = indirectionIndex }
final override int getIndirectionIndex() { result = indirectionIndex }
}
newtype TPosition =
@@ -1322,7 +1323,7 @@ import IsUnreachableInCall
* Holds if access paths with `c` at their head always should be tracked at high
* precision. This disables adaptive access path precision for such access paths.
*/
predicate forceHighPrecision(Content c) { none() }
predicate forceHighPrecision(Content c) { c instanceof ElementContent }
/** Holds if `n` should be hidden from path explanations. */
predicate nodeIsHidden(Node n) {
@@ -1393,7 +1394,8 @@ private predicate unionHasApproxName(Cpp::Union u, string s) { s = u.getName().c
cached
private newtype TContentApprox =
TFieldApproxContent(string s) { fieldHasApproxName(_, s) } or
TUnionApproxContent(string s) { unionHasApproxName(_, s) }
TUnionApproxContent(string s) { unionHasApproxName(_, s) } or
TElementApproxContent()
/** An approximated `Content`. */
class ContentApprox extends TContentApprox {
@@ -1424,6 +1426,10 @@ private class UnionApproxContent extends ContentApprox, TUnionApproxContent {
final override string toString() { result = s }
}
private class ElementApproxContent extends ContentApprox, TElementApproxContent {
final override string toString() { result = "ElementApprox" }
}
/** Gets an approximated value for content `c`. */
pragma[inline]
ContentApprox getContentApprox(Content c) {
@@ -1438,6 +1444,9 @@ ContentApprox getContentApprox(Content c) {
u = c.(UnionContent).getUnion() and
unionHasApproxName(u, prefix)
)
or
c instanceof ElementContent and
result instanceof ElementApproxContent
}
/**
@@ -1697,6 +1706,14 @@ class DataFlowSecondLevelScope extends TDataFlowSecondLevelScope {
/** Gets the second-level scope containing the node `n`, if any. */
DataFlowSecondLevelScope getSecondLevelScope(Node n) { result.getANode() = n }
/**
* Gets the maximum number of indirections to use for `ElementContent`.
*
* This should be equal to the largest number of stars (i.e., `*`s) in any
* `Element` content across all of our MaD summaries, sources, and sinks.
*/
int getMaxElementContentIndirectionIndex() { result = 5 }
/**
* Module that defines flow through iterators.
* For example,
@@ -1809,7 +1826,7 @@ module IteratorFlow {
* Holds if `(bb, i)` contains a write to an iterator that may have been obtained
* by calling `begin` (or related functions) on the variable `v`.
*/
predicate variableWrite(IRBlock bb, int i, SourceVariable v, boolean certain) {
predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
certain = false and
exists(GetsIteratorCall beginCall, Instruction writeToDeref, IRBlock bbQual, int iQual |
isIteratorStoreInstruction(beginCall, writeToDeref) and
@@ -1820,7 +1837,7 @@ module IteratorFlow {
}
/** Holds if `(bb, i)` reads the container variable `v`. */
predicate variableRead(IRBlock bb, int i, SourceVariable v, boolean certain) {
predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
Ssa::variableRead(bb, i, v, certain)
}
}

22
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
View File

@@ -2083,6 +2083,9 @@ private newtype TContent =
indirectionIndex =
[1 .. max(Ssa::getMaxIndirectionsForType(getAFieldWithSize(u, bytes).getUnspecifiedType()))]
)
} or
TElementContent(int indirectionIndex) {
indirectionIndex = [1 .. getMaxElementContentIndirectionIndex()]
}
/**
@@ -2193,6 +2196,25 @@ class UnionContent extends Content, TUnionContent {
}
}
/**
* A `Content` that represents one of the elements of a
* container (e.g., `std::vector`).
*/
class ElementContent extends Content, TElementContent {
int indirectionIndex;
ElementContent() { this = TElementContent(indirectionIndex) }
pragma[inline]
override int getIndirectionIndex() {
pragma[only_bind_into](result) = pragma[only_bind_out](indirectionIndex)
}
override predicate impliesClearOf(Content c) { none() }
override string toString() { result = contentStars(this) + "element" }
}
/**
* An entity that represents a set of `Content`s.
*

36
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll
View File

@@ -104,7 +104,7 @@ predicate hasRawIndirectInstruction(Instruction instr, int indirectionIndex) {
cached
private newtype TDefImpl =
TDefAddressImpl(BaseIRVariable v) or
TDefAddressImpl(BaseSourceVariable v) or
TDirectDefImpl(Operand address, int indirectionIndex) {
isDef(_, _, address, _, _, indirectionIndex)
} or
@@ -325,9 +325,9 @@ private Instruction getInitializationTargetAddress(IRVariable v) {
)
}
/** An initial definition of an `IRVariable`'s address. */
private class DefAddressImpl extends DefImpl, TDefAddressImpl {
BaseIRVariable v;
/** An initial definition of an SSA variable address. */
abstract private class DefAddressImpl extends DefImpl, TDefAddressImpl {
BaseSourceVariable v;
DefAddressImpl() {
this = TDefAddressImpl(v) and
@@ -342,6 +342,19 @@ private class DefAddressImpl extends DefImpl, TDefAddressImpl {
final override Node0Impl getValue() { none() }
override Cpp::Location getLocation() { result = v.getLocation() }
final override SourceVariable getSourceVariable() {
result.getBaseVariable() = v and
result.getIndirection() = 0
}
final override BaseSourceVariable getBaseSourceVariable() { result = v }
}
private class DefVariableAddressImpl extends DefAddressImpl {
override BaseIRVariable v;
final override predicate hasIndexInBlock(IRBlock block, int index) {
exists(IRVariable var | var = v.getIRVariable() |
block.getInstruction(index) = getInitializationTargetAddress(var)
@@ -353,15 +366,14 @@ private class DefAddressImpl extends DefImpl, TDefAddressImpl {
index = 0
)
}
}
override Cpp::Location getLocation() { result = v.getIRVariable().getLocation() }
private class DefCallAddressImpl extends DefAddressImpl {
override BaseCallVariable v;
final override SourceVariable getSourceVariable() {
result.getBaseVariable() = v and
result.getIndirection() = 0
final override predicate hasIndexInBlock(IRBlock block, int index) {
block.getInstruction(index) = v.getCallInstruction()
}
final override BaseSourceVariable getBaseSourceVariable() { result = v }
}
private class DirectDef extends DefImpl, TDirectDefImpl {
@@ -981,7 +993,7 @@ private module SsaInput implements SsaImplCommon::InputSig<Location> {
* Holds if the `i`'th write in block `bb` writes to the variable `v`.
* `certain` is `true` if the write is guaranteed to overwrite the entire variable.
*/
predicate variableWrite(IRBlock bb, int i, SourceVariable v, boolean certain) {
predicate variableWrite(BasicBlock bb, int i, SourceVariable v, boolean certain) {
DataFlowImplCommon::forceCachingInSameStage() and
(
exists(DefImpl def | def.hasIndexInBlock(bb, i, v) |
@@ -999,7 +1011,7 @@ private module SsaInput implements SsaImplCommon::InputSig<Location> {
* Holds if the `i`'th read in block `bb` reads to the variable `v`.
* `certain` is `true` if the read is guaranteed. For C++, this is always the case.
*/
predicate variableRead(IRBlock bb, int i, SourceVariable v, boolean certain) {
predicate variableRead(BasicBlock bb, int i, SourceVariable v, boolean certain) {
exists(UseImpl use | use.hasIndexInBlock(bb, i, v) |
if use.isCertain() then certain = true else certain = false
)

10
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
View File

@@ -757,13 +757,19 @@ import Cached
* between the SSA pruning stage, and the final SSA stage.
*/
module InputSigCommon {
class BasicBlock = IRBlock;
class BasicBlock extends IRBlock {
ControlFlowNode getNode(int i) { result = this.getInstruction(i) }
int length() { result = this.getInstructionCount() }
}
class ControlFlowNode = Instruction;
BasicBlock getImmediateBasicBlockDominator(BasicBlock bb) { result.immediatelyDominates(bb) }
BasicBlock getABasicBlockSuccessor(BasicBlock bb) { result = bb.getASuccessor() }
class ExitBasicBlock extends IRBlock {
class ExitBasicBlock extends BasicBlock {
ExitBasicBlock() { this.getLastInstruction() instanceof ExitFunctionInstruction }
}
}

5
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -147,7 +147,10 @@ predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink, st
* of `c` at sinks and inputs to additional taint steps.
*/
bindingset[node]
predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) { none() }
predicate defaultImplicitTaintRead(DataFlow::Node node, DataFlow::ContentSet c) {
node instanceof ArgumentNode and
c.isSingleton(any(ElementContent ec))
}
/**
* Holds if `node` should be a sanitizer in all global taint flow configurations

189
cpp/ql/lib/semmle/code/cpp/models/implementations/StdContainer.qll
View File

@@ -2,7 +2,7 @@
* Provides models for C++ containers `std::array`, `std::vector`, `std::deque`, `std::list` and `std::forward_list`.
*/
import semmle.code.cpp.models.interfaces.Taint
import semmle.code.cpp.models.interfaces.FlowSource
import semmle.code.cpp.models.interfaces.Iterator
/**
@@ -55,73 +55,6 @@ private class Vector extends StdSequenceContainer {
Vector() { this.hasQualifiedName(["std", "bsl"], "vector") }
}
/**
* Additional model for standard container constructors that reference the
* value type of the container (that is, the `T` in `std::vector<T>`). For
* example the fill constructor:
* ```
* std::vector<std::string> v(100, potentially_tainted_string);
* ```
*/
private class StdSequenceContainerConstructor extends Constructor, TaintFunction {
StdSequenceContainerConstructor() {
this.getDeclaringType() instanceof Vector or
this.getDeclaringType() instanceof Deque or
this.getDeclaringType() instanceof List or
this.getDeclaringType() instanceof ForwardList
}
/**
* Gets the index of a parameter to this function that is a reference to the
* value type of the container.
*/
int getAValueTypeParameterIndex() {
this.getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() =
this.getDeclaringType().getTemplateArgument(0).(Type).getUnspecifiedType() // i.e. the `T` of this `std::vector<T>`
}
/**
* Gets the index of a parameter to this function that is an iterator.
*/
int getAnIteratorParameterIndex() { this.getParameter(result).getType() instanceof Iterator }
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// taint flow from any parameter of the value type to the returned object
(
input.isParameterDeref(this.getAValueTypeParameterIndex()) or
input.isParameter(this.getAnIteratorParameterIndex())
) and
(
output.isReturnValue() // TODO: this is only needed for AST data flow, which treats constructors as returning the new object
or
output.isQualifierObject()
)
}
}
/**
* The standard container function `data`.
*/
private class StdSequenceContainerData extends TaintFunction {
StdSequenceContainerData() {
this.getClassAndName("data") instanceof Array or
this.getClassAndName("data") instanceof Vector
}
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from container itself (qualifier) to return value
input.isQualifierObject() and
output.isReturnValueDeref()
or
// reverse flow from returned reference to the qualifier (for writes to
// `data`)
input.isReturnValueDeref() and
output.isQualifierObject()
}
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
}
/**
* The standard container functions `push_back` and `push_front`.
*/
@@ -143,35 +76,6 @@ class StdSequenceContainerPush extends MemberFunction {
}
}
private class StdSequenceContainerPushModel extends StdSequenceContainerPush, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from parameter to qualifier
input.isParameterDeref(0) and
output.isQualifierObject()
}
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
}
/**
* The standard container functions `front` and `back`.
*/
private class StdSequenceContainerFrontBack extends TaintFunction {
StdSequenceContainerFrontBack() {
this.getClassAndName(["front", "back"]) instanceof Array or
this.getClassAndName(["front", "back"]) instanceof Deque or
this.getClassAndName("front") instanceof ForwardList or
this.getClassAndName(["front", "back"]) instanceof List or
this.getClassAndName(["front", "back"]) instanceof Vector
}
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from object to returned reference
input.isQualifierObject() and
output.isReturnValueDeref()
}
}
/**
* The standard container functions `insert` and `insert_after`.
*/
@@ -198,58 +102,6 @@ class StdSequenceContainerInsert extends MemberFunction {
int getAnIteratorParameterIndex() { this.getParameter(result).getType() instanceof Iterator }
}
private class StdSequenceContainerInsertModel extends StdSequenceContainerInsert, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from parameter to container itself (qualifier) and return value
(
input.isQualifierObject() or
input.isParameterDeref(this.getAValueTypeParameterIndex()) or
input.isParameter(this.getAnIteratorParameterIndex())
) and
(
output.isQualifierObject() or
output.isReturnValue()
)
}
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
}
/**
* The standard container function `assign`.
*/
private class StdSequenceContainerAssign extends TaintFunction {
StdSequenceContainerAssign() {
this.getClassAndName("assign") instanceof Deque or
this.getClassAndName("assign") instanceof ForwardList or
this.getClassAndName("assign") instanceof List or
this.getClassAndName("assign") instanceof Vector
}
/**
* Gets the index of a parameter to this function that is a reference to the
* value type of the container.
*/
int getAValueTypeParameterIndex() {
this.getParameter(result).getUnspecifiedType().(ReferenceType).getBaseType() =
this.getDeclaringType().getTemplateArgument(0).(Type).getUnspecifiedType() // i.e. the `T` of this `std::vector<T>`
}
/**
* Gets the index of a parameter to this function that is an iterator.
*/
int getAnIteratorParameterIndex() { this.getParameter(result).getType() instanceof Iterator }
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from parameter to container itself (qualifier)
(
input.isParameterDeref(this.getAValueTypeParameterIndex()) or
input.isParameter(this.getAnIteratorParameterIndex())
) and
output.isQualifierObject()
}
}
/**
* The standard container functions `at` and `operator[]`.
*/
@@ -261,20 +113,6 @@ class StdSequenceContainerAt extends MemberFunction {
}
}
private class StdSequenceContainerAtModel extends StdSequenceContainerAt, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from qualifier to referenced return value
input.isQualifierObject() and
output.isReturnValueDeref()
or
// reverse flow from returned reference to the qualifier
input.isReturnValueDeref() and
output.isQualifierObject()
}
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
}
/**
* The standard `emplace` function.
*/
@@ -297,20 +135,6 @@ class StdSequenceEmplace extends MemberFunction {
}
}
private class StdSequenceEmplaceModel extends StdSequenceEmplace, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from any parameter except the position iterator to qualifier and return value
// (here we assume taint flow from any constructor parameter to the constructed object)
input.isParameterDeref([1 .. this.getNumberOfParameters() - 1]) and
(
output.isQualifierObject() or
output.isReturnValue()
)
}
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
}
/**
* The standard vector `emplace` function.
*/
@@ -340,17 +164,6 @@ class StdSequenceEmplaceBack extends MemberFunction {
}
}
private class StdSequenceEmplaceBackModel extends StdSequenceEmplaceBack, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// flow from any parameter to qualifier
// (here we assume taint flow from any constructor parameter to the constructed object)
input.isParameterDeref([0 .. this.getNumberOfParameters() - 1]) and
output.isQualifierObject()
}
override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject() }
}
/**
* The standard vector `emplace_back` function.
*/

2
cpp/ql/lib/semmle/code/cpp/models/implementations/StdString.qll
View File

@@ -66,7 +66,7 @@ abstract private class StdStringTaintFunction extends TaintFunction {
* Gets the index of a parameter to this function that is an iterator.
*/
final int getAnIteratorParameterIndex() {
this.getParameter(result).getType() instanceof Iterator
this.getParameter(result).getUnspecifiedType() instanceof Iterator
}
}

38
cpp/ql/lib/semmlecode.cpp.dbscheme
View File

@@ -1748,6 +1748,25 @@ case @expr.kind of
| 361 = @isvoid
| 362 = @isvolatile
| 363 = @reuseexpr
| 364 = @istriviallycopyassignable
| 365 = @isassignablenopreconditioncheck
| 366 = @referencebindstotemporary
| 367 = @issameas
| 368 = @builtinhasattribute
| 369 = @ispointerinterconvertiblewithclass
| 370 = @builtinispointerinterconvertiblewithclass
| 371 = @iscorrespondingmember
| 372 = @builtiniscorrespondingmember
| 373 = @isboundedarray
| 374 = @isunboundedarray
| 375 = @isreferenceable
| 378 = @isnothrowconvertible
| 379 = @referenceconstructsfromtemporary
| 380 = @referenceconvertsfromtemporary
| 381 = @isconvertible
| 382 = @isvalidwinrttype
| 383 = @iswinclass
| 384 = @iswininterface
;
@var_args_expr = @vastartexpr
@@ -1842,6 +1861,25 @@ case @expr.kind of
| @isunsigned
| @isvoid
| @isvolatile
| @istriviallycopyassignable
| @isassignablenopreconditioncheck
| @referencebindstotemporary
| @issameas
| @builtinhasattribute
| @ispointerinterconvertiblewithclass
| @builtinispointerinterconvertiblewithclass
| @iscorrespondingmember
| @builtiniscorrespondingmember
| @isboundedarray
| @isunboundedarray
| @isreferenceable
| @isnothrowconvertible
| @referenceconstructsfromtemporary
| @referenceconvertsfromtemporary
| @isconvertible
| @isvalidwinrttype
| @iswinclass
| @iswininterface
;
new_allocated_type(

5995
cpp/ql/lib/semmlecode.cpp.dbscheme.stats
View File

File diff suppressed because it is too large Load Diff

2251
cpp/ql/lib/upgrades/abfce5c170f93e281948f7689ece373464fdaf87/old.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2289
cpp/ql/lib/upgrades/abfce5c170f93e281948f7689ece373464fdaf87/semmlecode.cpp.dbscheme Normal file
View File

File diff suppressed because it is too large Load Diff

2
cpp/ql/lib/upgrades/abfce5c170f93e281948f7689ece373464fdaf87/upgrade.properties Normal file
View File

@@ -0,0 +1,2 @@
description: Add new builtin operations
compatibility: backwards

4
cpp/ql/src/CHANGELOG.md
View File

@@ -1,3 +1,7 @@
## 1.0.3
No user-facing changes.
## 1.0.2
No user-facing changes.

2
cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
View File

@@ -172,5 +172,5 @@ where
not arg.isFromUninstantiatedTemplate(_) and
not actual.getUnspecifiedType() instanceof ErroneousType
select arg,
"This argument should be of type '" + expected.getName() + "' but is of type '" +
"This format specifier for type '" + expected.getName() + "' does not match the argument type '" +
actual.getUnspecifiedType().getName() + "'."

7
cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.cpp
View File

@@ -1,7 +0,0 @@
Record* fixRecord(Record* r) {
Record myRecord = *r;
delete r;
myRecord.fix();
return &myRecord; //returns reference to myRecord, which is a stack-allocated object
}

19
cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemory.qhelp
View File

@@ -5,22 +5,23 @@
<overview>
<p>This rule finds return statements that return pointers to an object allocated on the stack.
The lifetime of a stack allocated memory location only lasts until the function returns, and
the contents of that memory become undefined after that. Clearly, using a pointer to stack
<p>This rule finds return statements that return pointers to an object allocated on the stack.
The lifetime of a stack allocated memory location only lasts until the function returns, and
the contents of that memory become undefined after that. Clearly, using a pointer to stack
memory after the function has already returned will have undefined results. </p>
</overview>
<recommendation>
<p>Use the functions of the <tt>malloc</tt> family to dynamically allocate memory on the heap for data that is used across function calls.</p>
<p>Use the functions of the <tt>malloc</tt> family, or <tt>new</tt>, to dynamically allocate memory on the heap for data that is used across function calls.</p>
</recommendation>
<example><sample src="ReturnStackAllocatedMemory.cpp" />
<example>
<p>The following example allocates an object on the stack and returns a pointer to it. This is incorrect because the object is deallocated
when the function returns, and the pointer becomes invalid.</p>
<sample src="ReturnStackAllocatedMemoryBad.cpp" />
<p>To fix this, allocate the object on the heap using <tt>new</tt> and return a pointer to the heap-allocated object.</p>
<sample src="ReturnStackAllocatedMemoryGood.cpp" />
</example>
<references>

5
cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemoryBad.cpp Normal file
View File

@@ -0,0 +1,5 @@
Record *mkRecord(int value) {
Record myRecord(value);
return &myRecord; // BAD: returns a pointer to `myRecord`, which is a stack-allocated object.
}

5
cpp/ql/src/Likely Bugs/Memory Management/ReturnStackAllocatedMemoryGood.cpp Normal file
View File

@@ -0,0 +1,5 @@
Record *mkRecord(int value) {
Record *myRecord = new Record(value);
return myRecord; // GOOD: returns a pointer to a `myRecord`, which is a heap-allocated object.
}

2
cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql
View File

@@ -4,7 +4,7 @@
* @kind problem
* @problem.severity warning
* @security-severity 9.3
* @precision medium
* @precision high
* @id cpp/unsafe-strncat
* @tags reliability
* correctness

17
cpp/ql/src/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero.c
View File

@@ -1,5 +1,14 @@
unsigned limit = get_limit();
unsigned total = 0;
while (limit - total > 0) { // wrong: if `total` is greater than `limit` this will underflow and continue executing the loop.
uint32_t limit = get_limit();
uint32_t total = 0;
while (limit - total > 0) { // BAD: if `total` is greater than `limit` this will underflow and continue executing the loop.
total += get_data();
}
}
while (total < limit) { // GOOD: never underflows here because there is no arithmetic.
total += get_data();
}
while ((int64_t)limit - total > 0) { // GOOD: never underflows here because the result always fits in an `int64_t`.
total += get_data();
}

12
cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRaceBad.c
View File

@@ -1,15 +1,17 @@
char *file_name;
FILE *f_ptr;
/* Initialize file_name */
f_ptr = fopen(file_name, "w");
if (f_ptr == NULL) {
/* Handle error */
}
/* ... */
if (chmod(file_name, S_IRUSR) == -1) {
/* Handle error */
}
}
fclose(f_ptr);

12
cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRaceGood.c
View File

@@ -1,8 +1,8 @@
char *file_name;
int fd;
/* Initialize file_name */
fd = open(
file_name,
O_WRONLY | O_CREAT | O_EXCL,
@@ -11,9 +11,11 @@ fd = open(
if (fd == -1) {
/* Handle error */
}
/* ... */
if (fchmod(fd, S_IRUSR) == -1) {
/* Handle error */
}
}
close(fd);

2
cpp/ql/src/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.cpp
View File

@@ -34,7 +34,7 @@ void good1(std::size_t length) noexcept {
// GOOD: the allocation failure is handled appropriately.
void good2(std::size_t length) noexcept {
int* dest = new int[length];
int* dest = new(std::nothrow) int[length];
if(!dest) {
return;
}

31
cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.c
View File

@@ -1,11 +1,38 @@
void write_default_config_bad() {
// BAD - this is world-writable so any user can overwrite the config
int out = creat(OUTFILE, 0666);
dprintf(out, DEFAULT_CONFIG);
if (out < 0) {
// handle error
}
dprintf(out, "%s", DEFAULT_CONFIG);
close(out);
}
void write_default_config_good() {
// GOOD - this allows only the current user to modify the file
int out = creat(OUTFILE, S_IWUSR | S_IRUSR);
dprintf(out, DEFAULT_CONFIG);
if (out < 0) {
// handle error
}
dprintf(out, "%s", DEFAULT_CONFIG);
close(out);
}
void write_default_config_good_2() {
// GOOD - this allows only the current user to modify the file
int out = open(OUTFILE, O_WRONLY | O_CREAT, S_IWUSR | S_IRUSR);
if (out < 0) {
// handle error
}
FILE *fd = fdopen(out, "w");
if (fd == NULL) {
close(out);
// handle error
}
fprintf(fd, "%s", DEFAULT_CONFIG);
fclose(fd);
}

5
cpp/ql/src/Security/CWE/CWE-732/DoNotCreateWorldWritable.qhelp
View File

@@ -29,10 +29,11 @@ so it is important that they cannot be controlled by an attacker.
</p>
<p>
The first example creates the default configuration file with the usual "default" Unix permissions, <code>0666</code>. This makes the
The first example creates the default configuration file with the usual "default" Unix permissions, <code>0666</code>. This makes the
file world-writable, so that an attacker could write in their own configuration that would be read by the program. The second example uses
more restrictive permissions: a combination of the standard Unix constants <code>S_IWUSR</code> and <code>S_IRUSR</code> which means that
only the current user will have read and write access to the file.
only the current user will have read and write access to the file. The third example shows another way to create a file with more restrictive
permissions if a <code>FILE *</code> stream pointer is required rather than a file descriptor.
</p>
<sample src="DoNotCreateWorldWritable.c" />

4
cpp/ql/src/change-notes/2024-07-08-unsafe-strncat-query.md Normal file
View File

@@ -0,0 +1,4 @@
---
category: queryMetadata
---
* The precision of `cpp/unsafe-strncat` ("Potentially unsafe call to strncat") has been increased to `high`. As a result, it will be run by default as part of the Code Scanning suite.

3
cpp/ql/src/change-notes/released/1.0.3.md Normal file
View File

@@ -0,0 +1,3 @@
## 1.0.3
No user-facing changes.

2
cpp/ql/src/codeql-pack.release.yml
View File

@@ -1,2 +1,2 @@
---
lastReleaseVersion: 1.0.2
lastReleaseVersion: 1.0.3

2
cpp/ql/src/qlpack.yml
View File

@@ -1,5 +1,5 @@
name: codeql/cpp-queries
version: 1.0.3-dev
version: 1.0.4-dev
groups:
- cpp
- queries

6
cpp/ql/test/library-tests/array_sizes/arr2.expected
View File

@@ -1,5 +1,11 @@
| file://:0:0:0:0 | char[6] | 6 |
| file://:0:0:0:0 | char[26] | 26 |
| file://:0:0:0:0 | char[] | |
| file://:0:0:0:0 | const char[6] | 6 |
| file://:0:0:0:0 | double[0] | 0 |
| file://:0:0:0:0 | double[3] | 3 |
| file://:0:0:0:0 | double[4] | 4 |
| file://:0:0:0:0 | double[] | |
| file://:0:0:0:0 | int[1] | 1 |
| file://:0:0:0:0 | int[11] | 11 |
| file://:0:0:0:0 | long[] | |

10
cpp/ql/test/library-tests/array_sizes/implicit_sizes.cpp Normal file
View File

@@ -0,0 +1,10 @@
// semmle-extractor-options: -std=c++20
double a1[]{1,2,3};
double* p1 = new double[]{1,2,3};
double* p2 = new double[0]{};
double* p3 = new double[]{};
char c[]{"Hello"};
char* d = new char[]{"Hello"};
double a2[](1,2,3);
double* p4 = new double[](1,2,3);
double* p5 = new double[4]{1,2}; // Size mismatch

6
cpp/ql/test/library-tests/array_sizes/new.expected Normal file
View File

@@ -0,0 +1,6 @@
| implicit_sizes.cpp:3:14:3:32 | new[] | 3 |
| implicit_sizes.cpp:4:14:4:28 | new[] | 0 |
| implicit_sizes.cpp:5:14:5:27 | new[] | 0 |
| implicit_sizes.cpp:7:11:7:29 | new[] | 6 |
| implicit_sizes.cpp:9:14:9:32 | new[] | 3 |
| implicit_sizes.cpp:10:14:10:31 | new[] | 4 |

4
cpp/ql/test/library-tests/array_sizes/new.ql Normal file
View File

@@ -0,0 +1,4 @@
import cpp
from NewArrayExpr nae
select nae, nae.getArraySize()

17
cpp/ql/test/library-tests/builtins/type_traits/clang.cpp
View File

@@ -1,4 +1,4 @@
// semmle-extractor-options: --clang --clang_version 100000
// semmle-extractor-options: --clang --clang_version 180000
struct S {
void f() {}
@@ -93,3 +93,18 @@ struct S2 {
bool bok_is_trivial1 = __is_trivial(int);
bool bok_is_trivial2 = __is_trivial(S2);
bool bok_reference_binds_to_temporary1 = __reference_binds_to_temporary(int&, long&);
bool bok_reference_binds_to_temporary2 = __reference_binds_to_temporary(int const &, long&);
bool b_is_same_as1 = __is_same_as(int, int);
bool b_is_same_as2 = __is_same_as(int, float);
bool b_is_bounded_array1 = __is_bounded_array(int[]);
bool b_is_bounded_array2 = __is_bounded_array(int[42]);
bool b_is_unbounded_array1 = __is_unbounded_array(int[]);
bool b_is_unbounded_array2 = __is_unbounded_array(int[42]);
bool b_is_referenceable1 = __is_referenceable(int);
bool b_is_referenceable2 = __is_referenceable(void);

104
cpp/ql/test/library-tests/builtins/type_traits/expr.expected
View File

@@ -125,9 +125,78 @@
| clang.cpp:94:24:94:40 | int | | <none> |
| clang.cpp:95:24:95:39 | S2 | | <none> |
| clang.cpp:95:24:95:39 | __is_trivial | S2 | 0 |
| clang.cpp:97:42:97:84 | __reference_binds_to_temporary | int &,long & | 0 |
| clang.cpp:97:42:97:84 | int & | | <none> |
| clang.cpp:97:42:97:84 | long & | | <none> |
| clang.cpp:98:42:98:91 | __reference_binds_to_temporary | const int &,long & | 1 |
| clang.cpp:98:42:98:91 | const int & | | <none> |
| clang.cpp:98:42:98:91 | long & | | <none> |
| clang.cpp:100:22:100:43 | __is_same_as | int,int | 1 |
| clang.cpp:100:22:100:43 | int | | <none> |
| clang.cpp:100:22:100:43 | int | | <none> |
| clang.cpp:101:22:101:45 | __is_same_as | int,float | 0 |
| clang.cpp:101:22:101:45 | float | | <none> |
| clang.cpp:101:22:101:45 | int | | <none> |
| clang.cpp:103:28:103:52 | __is_bounded_array | int[] | 0 |
| clang.cpp:103:28:103:52 | int[] | | <none> |
| clang.cpp:104:28:104:54 | __is_bounded_array | int[42] | 1 |
| clang.cpp:104:28:104:54 | int[42] | | <none> |
| clang.cpp:104:51:104:52 | 42 | | 42 |
| clang.cpp:104:51:104:52 | (unsigned long)... | | 42 |
| clang.cpp:106:30:106:56 | __is_unbounded_array | int[] | 1 |
| clang.cpp:106:30:106:56 | int[] | | <none> |
| clang.cpp:107:30:107:58 | __is_unbounded_array | int[42] | 0 |
| clang.cpp:107:30:107:58 | int[42] | | <none> |
| clang.cpp:107:55:107:56 | 42 | | 42 |
| clang.cpp:107:55:107:56 | (unsigned long)... | | 42 |
| clang.cpp:109:28:109:50 | __is_referenceable | int | 1 |
| clang.cpp:109:28:109:50 | int | | <none> |
| clang.cpp:110:28:110:51 | __is_referenceable | void | 0 |
| clang.cpp:110:28:110:51 | void | | <none> |
| file://:0:0:0:0 | 0 | | 0 |
| file://:0:0:0:0 | 1 | | 1 |
| file://:0:0:0:0 | 2 | | 2 |
| gcc.cpp:3:25:3:25 | 8 | | 8 |
| gcc.cpp:4:25:4:59 | 0 | | 0 |
| gcc.cpp:4:25:4:59 | __builtin_has_attribute | v,0 | 1 |
| gcc.cpp:4:49:4:49 | v | | <none> |
| gcc.cpp:5:25:5:62 | 0 | | 0 |
| gcc.cpp:5:25:5:62 | __builtin_has_attribute | v,0 | 0 |
| gcc.cpp:5:49:5:49 | v | | <none> |
| gcc.cpp:13:50:13:111 | __builtin_is_pointer_interconvertible_with_class | i | 1 |
| gcc.cpp:13:99:13:110 | i | | <none> |
| gcc.cpp:14:50:14:111 | __builtin_is_pointer_interconvertible_with_class | d | 0 |
| gcc.cpp:14:99:14:110 | d | | <none> |
| gcc.cpp:16:35:16:95 | __builtin_is_corresponding_member | i,i | 1 |
| gcc.cpp:16:69:16:80 | i | | <none> |
| gcc.cpp:16:83:16:94 | i | | <none> |
| gcc.cpp:17:35:17:95 | __builtin_is_corresponding_member | i,d | 0 |
| gcc.cpp:17:69:17:80 | i | | <none> |
| gcc.cpp:17:83:17:94 | d | | <none> |
| gcc.cpp:19:34:19:67 | __is_nothrow_convertible | int,int | 1 |
| gcc.cpp:19:34:19:67 | int | | <none> |
| gcc.cpp:19:34:19:67 | int | | <none> |
| gcc.cpp:20:34:20:72 | __is_nothrow_convertible | a_struct,int | 0 |
| gcc.cpp:20:34:20:72 | a_struct | | <none> |
| gcc.cpp:20:34:20:72 | int | | <none> |
| gcc.cpp:22:26:22:51 | __is_convertible | int,int | 1 |
| gcc.cpp:22:26:22:51 | int | | <none> |
| gcc.cpp:22:26:22:51 | int | | <none> |
| gcc.cpp:23:26:23:56 | __is_convertible | a_struct,int | 0 |
| gcc.cpp:23:26:23:56 | a_struct | | <none> |
| gcc.cpp:23:26:23:56 | int | | <none> |
| gcc.cpp:25:47:25:95 | __reference_constructs_from_temporary | int &&,int | 1 |
| gcc.cpp:25:47:25:95 | int | | <none> |
| gcc.cpp:25:47:25:95 | int && | | <none> |
| gcc.cpp:26:47:26:97 | __reference_constructs_from_temporary | int &&,int && | 0 |
| gcc.cpp:26:47:26:97 | int && | | <none> |
| gcc.cpp:26:47:26:97 | int && | | <none> |
| gcc.cpp:28:45:28:91 | __reference_converts_from_temporary | int &&,int | 1 |
| gcc.cpp:28:45:28:91 | int | | <none> |
| gcc.cpp:28:45:28:91 | int && | | <none> |
| gcc.cpp:29:45:29:93 | __reference_converts_from_temporary | int &&,int && | 0 |
| gcc.cpp:29:45:29:93 | int && | | <none> |
| gcc.cpp:29:45:29:93 | int && | | <none> |
| ms.cpp:38:41:38:45 | 0 | | 0 |
| ms.cpp:88:27:88:45 | __has_assign | empty | 0 |
| ms.cpp:88:27:88:45 | empty | | <none> |
@@ -452,3 +521,38 @@
| ms.cpp:272:51:272:104 | __is_pointer_interconvertible_base_of | empty,abstract | 0 |
| ms.cpp:272:51:272:104 | abstract | | <none> |
| ms.cpp:272:51:272:104 | empty | | <none> |
| ms.cpp:274:44:274:85 | __is_trivially_copy_assignable | has_assign | 0 |
| ms.cpp:274:44:274:85 | has_assign | | <none> |
| ms.cpp:275:44:275:78 | __is_trivially_copy_assignable | int | 1 |
| ms.cpp:275:44:275:78 | int | | <none> |
| ms.cpp:277:51:277:107 | __is_assignable_no_precondition_check | a_struct,a_struct | 1 |
| ms.cpp:277:51:277:107 | a_struct | | <none> |
| ms.cpp:277:51:277:107 | a_struct | | <none> |
| ms.cpp:278:51:278:104 | __is_assignable_no_precondition_check | a_struct,empty | 0 |
| ms.cpp:278:51:278:104 | a_struct | | <none> |
| ms.cpp:278:51:278:104 | empty | | <none> |
| ms.cpp:279:51:279:102 | __is_assignable_no_precondition_check | a_struct,int | 0 |
| ms.cpp:279:51:279:102 | a_struct | | <none> |
| ms.cpp:279:51:279:102 | int | | <none> |
| ms.cpp:281:54:281:117 | __is_pointer_interconvertible_with_class | a_struct,i | 1 |
| ms.cpp:281:54:281:117 | a_struct | | <none> |
| ms.cpp:281:105:281:116 | i | | <none> |
| ms.cpp:282:54:282:117 | __is_pointer_interconvertible_with_class | a_struct,d | 0 |
| ms.cpp:282:54:282:117 | a_struct | | <none> |
| ms.cpp:282:105:282:116 | d | | <none> |
| ms.cpp:284:39:284:111 | __is_corresponding_member | a_struct,a_struct,i,i | 1 |
| ms.cpp:284:39:284:111 | a_struct | | <none> |
| ms.cpp:284:39:284:111 | a_struct | | <none> |
| ms.cpp:284:85:284:96 | i | | <none> |
| ms.cpp:284:99:284:110 | i | | <none> |
| ms.cpp:285:39:285:111 | __is_corresponding_member | a_struct,a_struct,i,d | 0 |
| ms.cpp:285:39:285:111 | a_struct | | <none> |
| ms.cpp:285:39:285:111 | a_struct | | <none> |
| ms.cpp:285:85:285:96 | i | | <none> |
| ms.cpp:285:99:285:110 | d | | <none> |
| ms.cpp:287:34:287:59 | __is_valid_winrt_type | int | 1 |
| ms.cpp:287:34:287:59 | int | | <none> |
| ms.cpp:288:27:288:45 | __is_win_class | int | 0 |
| ms.cpp:288:27:288:45 | int | | <none> |
| ms.cpp:289:31:289:53 | __is_win_interface | int | 0 |
| ms.cpp:289:31:289:53 | int | | <none> |

29
cpp/ql/test/library-tests/builtins/type_traits/gcc.cpp Normal file
View File

@@ -0,0 +1,29 @@
// semmle-extractor-options: --gnu_version 130000
__attribute__ ((aligned(8))) int v;
bool b_has_attribute1 = __builtin_has_attribute(v, aligned);
bool b_has_attribute2 = __builtin_has_attribute(v, aligned(4));
struct a_struct {
int i;
double d;
};
bool b_is_pointer_interconvertible_with_class1 = __builtin_is_pointer_interconvertible_with_class(&a_struct::i);
bool b_is_pointer_interconvertible_with_class2 = __builtin_is_pointer_interconvertible_with_class(&a_struct::d);
bool b_is_corresponding_member1 = __builtin_is_corresponding_member(&a_struct::i, &a_struct::i);
bool b_is_corresponding_member2 = __builtin_is_corresponding_member(&a_struct::i, &a_struct::d);
bool b_is_nothrow_convertible1 = __is_nothrow_convertible(int, int);
bool b_is_nothrow_convertible2 = __is_nothrow_convertible(a_struct, int);
bool b_is_convertible1 = __is_convertible(int, int);
bool b_is_convertible2 = __is_convertible(a_struct, int);
bool b_reference_constructs_from_temporary1 = __reference_constructs_from_temporary(int&&, int);
bool b_reference_constructs_from_temporary2 = __reference_constructs_from_temporary(int&&, int&&);
bool b_reference_converts_from_temporary1 = __reference_converts_from_temporary(int&&, int);
bool b_reference_converts_from_temporary2 = __reference_converts_from_temporary(int&&, int&&);

17
cpp/ql/test/library-tests/builtins/type_traits/ms.cpp
View File

@@ -270,4 +270,21 @@ void f(void) {
bool b_is_pointer_interconvertible_base_of1 = __is_pointer_interconvertible_base_of(empty, empty);
bool b_is_pointer_interconvertible_base_of2 = __is_pointer_interconvertible_base_of(empty, abstract);
bool b_is_trivially_copy_assignable1 = __is_trivially_copy_assignable(has_assign);
bool b_is_trivially_copy_assignable2 = __is_trivially_copy_assignable(int);
bool b_is_assignable_no_precondition_check1 = __is_assignable_no_precondition_check(a_struct, a_struct);
bool b_is_assignable_no_precondition_check2 = __is_assignable_no_precondition_check(a_struct, empty);
bool b_is_assignable_no_precondition_check3 = __is_assignable_no_precondition_check(a_struct, int);
bool b_is_pointer_interconvertible_with_class1 = __is_pointer_interconvertible_with_class(a_struct, &a_struct::i);
bool b_is_pointer_interconvertible_with_class2 = __is_pointer_interconvertible_with_class(a_struct, &a_struct::d);
bool b_is_corresponding_member1 = __is_corresponding_member(a_struct, a_struct, &a_struct::i, &a_struct::i);
bool b_is_corresponding_member2 = __is_corresponding_member(a_struct, a_struct, &a_struct::i, &a_struct::d);
bool b_is_valid_winrt_type = __is_valid_winrt_type(int);
bool b_is_win_class = __is_win_class(int);
bool b_is_win_interface = __is_win_interface(int);
}

29
cpp/ql/test/library-tests/dataflow/calls-as-ssa-variables/test.cpp Normal file
View File

@@ -0,0 +1,29 @@
namespace std
{
struct ptrdiff_t;
struct input_iterator_tag
{
};
struct forward_iterator_tag : public input_iterator_tag
{
};
}
struct A
{
using value_type = int;
using difference_type = std::ptrdiff_t;
using pointer = int*;
using reference = int&;
using iterator_category = std::forward_iterator_tag;
};
A get();
void test()
{
while (true)
{
auto &&x = get();
}
}

4
cpp/ql/test/library-tests/dataflow/calls-as-ssa-variables/test.expected Normal file
View File

@@ -0,0 +1,4 @@
edges
nodes
subpaths
#select

23
cpp/ql/test/library-tests/dataflow/calls-as-ssa-variables/test.ql Normal file
View File

@@ -0,0 +1,23 @@
/**
* @kind path-problem
*/
import semmle.code.cpp.ir.IR
import semmle.code.cpp.dataflow.new.DataFlow
import Flow::PathGraph
module Config implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asInstruction().(VariableAddressInstruction).getIRVariable() instanceof IRTempVariable
}
predicate isSink(DataFlow::Node sink) {
sink.asInstruction().(CallInstruction).getStaticCallTarget().hasName("get")
}
}
module Flow = DataFlow::Global<Config>;
from Flow::PathNode source, Flow::PathNode sink
where Flow::flowPath(source, sink)
select sink.getNode(), source, sink, ""

36
cpp/ql/test/library-tests/dataflow/dataflow-tests/type-bugs.expected
View File

@@ -1,5 +1,41 @@
astTypeBugs
irTypeBugs
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary param] *0 in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary param] this in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element[****] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element[***] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element[**] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] read: Argument[*0].Element[*] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element[****] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element[***] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element[**] in iterator |
| ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | ../../../include/iterator.h:21:3:21:10 | [summary] to write: Argument[this].Element[*] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary param] *0 in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary param] this in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element[****] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element[***] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element[**] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] read: Argument[*0].Element[*] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element[****] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element[***] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element[**] in iterator |
| ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | ../../../include/iterator.h:22:3:22:10 | [summary] to write: Argument[this].Element[*] in iterator |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary param] this in operator* |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary] read: Argument[this].Element in operator* |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary] read: Argument[this].Element[*] in operator* |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary] to write: ReturnValue[**] in operator* |
| ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | ../../../include/iterator.h:30:18:30:26 | [summary] to write: ReturnValue[*] in operator* |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary param] this in operator-> |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary] read: Argument[this].Element in operator-> |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary] read: Argument[this].Element[*] in operator-> |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary] to write: ReturnValue[**] in operator-> |
| ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | ../../../include/iterator.h:31:16:31:25 | [summary] to write: ReturnValue[*] in operator-> |
incorrectBaseType
| clang.cpp:22:8:22:20 | *& ... | Expected 'Node.getType()' to be int, but it was int * |
| clang.cpp:23:17:23:29 | *& ... | Expected 'Node.getType()' to be int, but it was int * |

26
cpp/ql/test/library-tests/dataflow/external-models/validatemodels.expected
View File

@@ -0,0 +1,26 @@
| Dubious member name "operator*" in summary model. |
| Dubious member name "operator->" in summary model. |
| Dubious member name "operator=" in summary model. |
| Dubious member name "operator[]" in summary model. |
| Dubious signature "(InputIterator,InputIterator,const Allocator &)" in summary model. |
| Dubious signature "(const deque &)" in summary model. |
| Dubious signature "(const deque &,const Allocator &)" in summary model. |
| Dubious signature "(const forward_list &)" in summary model. |
| Dubious signature "(const forward_list &,const Allocator &)" in summary model. |
| Dubious signature "(const list &)" in summary model. |
| Dubious signature "(const list &,const Allocator &)" in summary model. |
| Dubious signature "(const vector &)" in summary model. |
| Dubious signature "(const vector &,const Allocator &)" in summary model. |
| Dubious signature "(const_iterator,T &&)" in summary model. |
| Dubious signature "(const_iterator,const T &)" in summary model. |
| Dubious signature "(const_iterator,size_type,const T &)" in summary model. |
| Dubious signature "(deque &&)" in summary model. |
| Dubious signature "(deque &&,const Allocator &)" in summary model. |
| Dubious signature "(forward_list &&)" in summary model. |
| Dubious signature "(forward_list &&,const Allocator &)" in summary model. |
| Dubious signature "(list &&)" in summary model. |
| Dubious signature "(list &&,const Allocator &)" in summary model. |
| Dubious signature "(size_type,const T &)" in summary model. |
| Dubious signature "(size_type,const T &,const Allocator &)" in summary model. |
| Dubious signature "(vector &&)" in summary model. |
| Dubious signature "(vector &&,const Allocator &)" in summary model. |

52
cpp/ql/test/library-tests/dataflow/models-as-data/FlowSummaryNode.expected
View File

@@ -4,29 +4,29 @@
| tests.cpp:145:6:145:28 | [summary] to write: ReturnValue[*] in madArg0ToReturnIndirect | ReturnNode | madArg0ToReturnIndirect | madArg0ToReturnIndirect |
| tests.cpp:147:5:147:28 | [summary param] 0 in madArg0ToReturnValueFlow | ParameterNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
| tests.cpp:147:5:147:28 | [summary] to write: ReturnValue in madArg0ToReturnValueFlow | ReturnNode | madArg0ToReturnValueFlow | madArg0ToReturnValueFlow |
| tests.cpp:148:5:148:27 | [summary param] 0 indirection in madArg0IndirectToReturn | ParameterNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
| tests.cpp:148:5:148:27 | [summary param] *0 in madArg0IndirectToReturn | ParameterNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
| tests.cpp:148:5:148:27 | [summary] to write: ReturnValue in madArg0IndirectToReturn | ReturnNode | madArg0IndirectToReturn | madArg0IndirectToReturn |
| tests.cpp:149:5:149:33 | [summary param] 0 indirection in madArg0DoubleIndirectToReturn | ParameterNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
| tests.cpp:149:5:149:33 | [summary param] **0 in madArg0DoubleIndirectToReturn | ParameterNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
| tests.cpp:149:5:149:33 | [summary] to write: ReturnValue in madArg0DoubleIndirectToReturn | ReturnNode | madArg0DoubleIndirectToReturn | madArg0DoubleIndirectToReturn |
| tests.cpp:150:5:150:30 | [summary param] 0 in madArg0NotIndirectToReturn | ParameterNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
| tests.cpp:150:5:150:30 | [summary] to write: ReturnValue in madArg0NotIndirectToReturn | ReturnNode | madArg0NotIndirectToReturn | madArg0NotIndirectToReturn |
| tests.cpp:151:6:151:26 | [summary param] 0 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
| tests.cpp:151:6:151:26 | [summary param] 1 indirection in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
| tests.cpp:151:6:151:26 | [summary] to write: Argument[1 indirection] in madArg0ToArg1Indirect | PostUpdateNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
| tests.cpp:152:6:152:34 | [summary param] 0 indirection in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
| tests.cpp:152:6:152:34 | [summary param] 1 indirection in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
| tests.cpp:152:6:152:34 | [summary] to write: Argument[1 indirection] in madArg0IndirectToArg1Indirect | PostUpdateNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
| tests.cpp:153:5:153:18 | [summary param] 0 indirection in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
| tests.cpp:153:5:153:18 | [summary param] 1 indirection in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
| tests.cpp:151:6:151:26 | [summary param] *1 in madArg0ToArg1Indirect | ParameterNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
| tests.cpp:151:6:151:26 | [summary] to write: Argument[*1] in madArg0ToArg1Indirect | PostUpdateNode | madArg0ToArg1Indirect | madArg0ToArg1Indirect |
| tests.cpp:152:6:152:34 | [summary param] *0 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
| tests.cpp:152:6:152:34 | [summary param] *1 in madArg0IndirectToArg1Indirect | ParameterNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
| tests.cpp:152:6:152:34 | [summary] to write: Argument[*1] in madArg0IndirectToArg1Indirect | PostUpdateNode | madArg0IndirectToArg1Indirect | madArg0IndirectToArg1Indirect |
| tests.cpp:153:5:153:18 | [summary param] 2 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
| tests.cpp:153:5:153:18 | [summary param] *0 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
| tests.cpp:153:5:153:18 | [summary param] *1 in madArgsComplex | ParameterNode | madArgsComplex | madArgsComplex |
| tests.cpp:153:5:153:18 | [summary] to write: ReturnValue in madArgsComplex | ReturnNode | madArgsComplex | madArgsComplex |
| tests.cpp:155:5:155:28 | [summary param] 2 in madAndImplementedComplex | ParameterNode | madAndImplementedComplex | madAndImplementedComplex |
| tests.cpp:155:5:155:28 | [summary] to write: ReturnValue in madAndImplementedComplex | ReturnNode | madAndImplementedComplex | madAndImplementedComplex |
| tests.cpp:160:5:160:24 | [summary param] 0 in madArg0FieldToReturn | ParameterNode | madArg0FieldToReturn | madArg0FieldToReturn |
| tests.cpp:160:5:160:24 | [summary] read: Argument[0].Field[value] in madArg0FieldToReturn | | madArg0FieldToReturn | madArg0FieldToReturn |
| tests.cpp:160:5:160:24 | [summary] to write: ReturnValue in madArg0FieldToReturn | ReturnNode | madArg0FieldToReturn | madArg0FieldToReturn |
| tests.cpp:161:5:161:32 | [summary param] 0 indirection in madArg0IndirectFieldToReturn | ParameterNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
| tests.cpp:161:5:161:32 | [summary] read: Argument[0 indirection].Field[value] in madArg0IndirectFieldToReturn | | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
| tests.cpp:161:5:161:32 | [summary param] *0 in madArg0IndirectFieldToReturn | ParameterNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
| tests.cpp:161:5:161:32 | [summary] read: Argument[*0].Field[value] in madArg0IndirectFieldToReturn | | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
| tests.cpp:161:5:161:32 | [summary] to write: ReturnValue in madArg0IndirectFieldToReturn | ReturnNode | madArg0IndirectFieldToReturn | madArg0IndirectFieldToReturn |
| tests.cpp:162:5:162:32 | [summary param] 0 in madArg0FieldIndirectToReturn | ParameterNode | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
| tests.cpp:162:5:162:32 | [summary] read: Argument[0].Field[*ptr] in madArg0FieldIndirectToReturn | | madArg0FieldIndirectToReturn | madArg0FieldIndirectToReturn |
@@ -41,36 +41,36 @@
| tests.cpp:165:13:165:40 | [summary] to write: ReturnValue in madArg0ToReturnFieldIndirect | ReturnNode | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
| tests.cpp:165:13:165:40 | [summary] to write: ReturnValue.Field[*ptr] in madArg0ToReturnFieldIndirect | | madArg0ToReturnFieldIndirect | madArg0ToReturnFieldIndirect |
| tests.cpp:284:7:284:19 | [summary param] 0 in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
| tests.cpp:284:7:284:19 | [summary param] this indirection in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
| tests.cpp:284:7:284:19 | [summary] to write: Argument[this indirection] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf |
| tests.cpp:285:6:285:20 | [summary param] this indirection in madSelfToReturn | ParameterNode | madSelfToReturn | madSelfToReturn |
| tests.cpp:284:7:284:19 | [summary param] this in madArg0ToSelf | ParameterNode | madArg0ToSelf | madArg0ToSelf |
| tests.cpp:284:7:284:19 | [summary] to write: Argument[this] in madArg0ToSelf | PostUpdateNode | madArg0ToSelf | madArg0ToSelf |
| tests.cpp:285:6:285:20 | [summary param] this in madSelfToReturn | ParameterNode | madSelfToReturn | madSelfToReturn |
| tests.cpp:285:6:285:20 | [summary] to write: ReturnValue in madSelfToReturn | ReturnNode | madSelfToReturn | madSelfToReturn |
| tests.cpp:287:7:287:20 | [summary param] 0 in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
| tests.cpp:287:7:287:20 | [summary param] this indirection in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
| tests.cpp:287:7:287:20 | [summary] to write: Argument[this indirection] in madArg0ToField | PostUpdateNode | madArg0ToField | madArg0ToField |
| tests.cpp:287:7:287:20 | [summary] to write: Argument[this indirection].Field[val] in madArg0ToField | | madArg0ToField | madArg0ToField |
| tests.cpp:288:6:288:21 | [summary param] this indirection in madFieldToReturn | ParameterNode | madFieldToReturn | madFieldToReturn |
| tests.cpp:288:6:288:21 | [summary] read: Argument[this indirection].Field[val] in madFieldToReturn | | madFieldToReturn | madFieldToReturn |
| tests.cpp:287:7:287:20 | [summary param] this in madArg0ToField | ParameterNode | madArg0ToField | madArg0ToField |
| tests.cpp:287:7:287:20 | [summary] to write: Argument[this] in madArg0ToField | PostUpdateNode | madArg0ToField | madArg0ToField |
| tests.cpp:287:7:287:20 | [summary] to write: Argument[this].Field[val] in madArg0ToField | | madArg0ToField | madArg0ToField |
| tests.cpp:288:6:288:21 | [summary param] this in madFieldToReturn | ParameterNode | madFieldToReturn | madFieldToReturn |
| tests.cpp:288:6:288:21 | [summary] read: Argument[this].Field[val] in madFieldToReturn | | madFieldToReturn | madFieldToReturn |
| tests.cpp:288:6:288:21 | [summary] to write: ReturnValue in madFieldToReturn | ReturnNode | madFieldToReturn | madFieldToReturn |
| tests.cpp:313:7:313:30 | [summary param] this indirection in namespaceMadSelfToReturn | ParameterNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
| tests.cpp:313:7:313:30 | [summary param] this in namespaceMadSelfToReturn | ParameterNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
| tests.cpp:313:7:313:30 | [summary] to write: ReturnValue in namespaceMadSelfToReturn | ReturnNode | namespaceMadSelfToReturn | namespaceMadSelfToReturn |
| tests.cpp:434:5:434:29 | [summary param] 0 in madCallArg0ReturnToReturn | ParameterNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
| tests.cpp:434:5:434:29 | [summary] read: Argument[0].Parameter[this] in madCallArg0ReturnToReturn | PostUpdateNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
| tests.cpp:434:5:434:29 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | PostUpdateNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
| tests.cpp:434:5:434:29 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturn | OutNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
| tests.cpp:434:5:434:29 | [summary] to write: Argument[0].Parameter[this] in madCallArg0ReturnToReturn | ArgumentNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
| tests.cpp:434:5:434:29 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturn | ArgumentNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
| tests.cpp:434:5:434:29 | [summary] to write: ReturnValue in madCallArg0ReturnToReturn | ReturnNode | madCallArg0ReturnToReturn | madCallArg0ReturnToReturn |
| tests.cpp:435:9:435:38 | [summary param] 0 in madCallArg0ReturnToReturnFirst | ParameterNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
| tests.cpp:435:9:435:38 | [summary] read: Argument[0].Parameter[this] in madCallArg0ReturnToReturnFirst | PostUpdateNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
| tests.cpp:435:9:435:38 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | PostUpdateNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
| tests.cpp:435:9:435:38 | [summary] read: Argument[0].ReturnValue in madCallArg0ReturnToReturnFirst | OutNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
| tests.cpp:435:9:435:38 | [summary] to write: Argument[0].Parameter[this] in madCallArg0ReturnToReturnFirst | ArgumentNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
| tests.cpp:435:9:435:38 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0ReturnToReturnFirst | ArgumentNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
| tests.cpp:435:9:435:38 | [summary] to write: ReturnValue in madCallArg0ReturnToReturnFirst | ReturnNode | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
| tests.cpp:435:9:435:38 | [summary] to write: ReturnValue.Field[first] in madCallArg0ReturnToReturnFirst | | madCallArg0ReturnToReturnFirst | madCallArg0ReturnToReturnFirst |
| tests.cpp:436:6:436:25 | [summary param] 0 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:436:6:436:25 | [summary param] 1 in madCallArg0WithValue | ParameterNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:436:6:436:25 | [summary] read: Argument[0].Parameter[0] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:436:6:436:25 | [summary] read: Argument[0].Parameter[this] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:436:6:436:25 | [summary] read: Argument[0].Parameter[this pointer] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:436:6:436:25 | [summary] to write: Argument[0].Parameter[0] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:436:6:436:25 | [summary] to write: Argument[0].Parameter[this] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:436:6:436:25 | [summary] to write: Argument[0].Parameter[this pointer] in madCallArg0WithValue | ArgumentNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:436:6:436:25 | [summary] to write: Argument[1] in madCallArg0WithValue | PostUpdateNode | madCallArg0WithValue | madCallArg0WithValue |
| tests.cpp:437:5:437:36 | [summary param] 1 in madCallReturnValueIgnoreFunction | ParameterNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |
| tests.cpp:437:5:437:36 | [summary] to write: ReturnValue in madCallReturnValueIgnoreFunction | ReturnNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction |

24
cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll
View File

@@ -80,22 +80,22 @@ private class TestSummaries extends SummaryModelCsv {
";;false;madArgsComplex;;;Argument[*0..1,2];ReturnValue;taint",
";;false;madAndImplementedComplex;;;Argument[2];ReturnValue;taint",
";;false;madArgsAny;;;Argument;ReturnValue;taint", // (syntax not supported)
";;false;madArg0FieldToReturn;;;Argument[0].value;ReturnValue;taint",
";;false;madArg0IndirectFieldToReturn;;;Argument[*0].value;ReturnValue;taint",
";;false;madArg0FieldIndirectToReturn;;;Argument[0].ptr[*];ReturnValue;taint",
";;false;madArg0ToReturnField;;;Argument[0];ReturnValue.value;taint",
";;false;madArg0ToReturnIndirectField;;;Argument[0];ReturnValue[*].value;taint",
";;false;madArg0ToReturnFieldIndirect;;;Argument[0];ReturnValue.ptr[*];taint",
";;false;madFieldToFieldVar;;;value;value2;taint",
";;false;madFieldToIndirectFieldVar;;;value;ptr[*];taint",
";;false;madIndirectFieldToFieldVar;;;;value;value2;taint", // not correctly expressed
";;false;madArg0FieldToReturn;;;Argument[0].Field[value];ReturnValue;taint",
";;false;madArg0IndirectFieldToReturn;;;Argument[*0].Field[value];ReturnValue;taint",
";;false;madArg0FieldIndirectToReturn;;;Argument[0].Field[*ptr];ReturnValue;taint",
";;false;madArg0ToReturnField;;;Argument[0];ReturnValue.Field[value];taint",
";;false;madArg0ToReturnIndirectField;;;Argument[0];ReturnValue[*].Field[value];taint",
";;false;madArg0ToReturnFieldIndirect;;;Argument[0];ReturnValue.Field[*ptr];taint",
";;false;madFieldToFieldVar;;;Field[value];Field[value2];taint",
";;false;madFieldToIndirectFieldVar;;;Field[value];Field[*ptr];taint",
";;false;madIndirectFieldToFieldVar;;;;Field[value];Field[value2];taint", // not correctly expressed
";MyClass;true;madArg0ToSelf;;;Argument[0];Argument[-1];taint",
";MyClass;true;madSelfToReturn;;;Argument[-1];ReturnValue;taint",
";MyClass;true;madArg0ToField;;;Argument[0];Argument[-1].val;taint",
";MyClass;true;madFieldToReturn;;;Argument[-1].val;ReturnValue;taint",
";MyClass;true;madArg0ToField;;;Argument[0];Argument[-1].Field[val];taint",
";MyClass;true;madFieldToReturn;;;Argument[-1].Field[val];ReturnValue;taint",
"MyNamespace;MyClass;true;namespaceMadSelfToReturn;;;Argument[-1];ReturnValue;taint",
";;false;madCallArg0ReturnToReturn;;;Argument[0].ReturnValue;ReturnValue;value",
";;false;madCallArg0ReturnToReturnFirst;;;Argument[0].ReturnValue;ReturnValue.first;value",
";;false;madCallArg0ReturnToReturnFirst;;;Argument[0].ReturnValue;ReturnValue.Field[first];value",
";;false;madCallArg0WithValue;;;Argument[1];Argument[0].Parameter[0];value",
";;false;madCallReturnValueIgnoreFunction;;;Argument[1];ReturnValue;value",
]

156
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -4361,6 +4361,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| string.cpp:446:17:446:17 | a | string.cpp:446:19:446:23 | call to begin | TAINT |
| string.cpp:446:17:446:17 | ref arg a | string.cpp:446:8:446:8 | a | |
| string.cpp:446:17:446:17 | ref arg a | string.cpp:447:8:447:8 | a | |
| string.cpp:446:17:446:25 | call to iterator | string.cpp:446:8:446:8 | ref arg a | TAINT |
| string.cpp:446:17:446:25 | call to iterator | string.cpp:446:10:446:15 | call to insert | TAINT |
| string.cpp:446:19:446:23 | call to begin | string.cpp:446:17:446:25 | call to iterator | TAINT |
| string.cpp:446:32:446:34 | 120 | string.cpp:446:8:446:8 | ref arg a | TAINT |
| string.cpp:446:32:446:34 | 120 | string.cpp:446:10:446:15 | call to insert | TAINT |
@@ -4369,6 +4371,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| string.cpp:449:17:449:17 | b | string.cpp:449:19:449:23 | call to begin | TAINT |
| string.cpp:449:17:449:17 | ref arg b | string.cpp:449:8:449:8 | b | |
| string.cpp:449:17:449:17 | ref arg b | string.cpp:450:8:450:8 | b | |
| string.cpp:449:17:449:25 | call to iterator | string.cpp:449:8:449:8 | ref arg b | TAINT |
| string.cpp:449:17:449:25 | call to iterator | string.cpp:449:10:449:15 | call to insert | TAINT |
| string.cpp:449:19:449:23 | call to begin | string.cpp:449:17:449:25 | call to iterator | TAINT |
| string.cpp:449:32:449:46 | call to source | string.cpp:449:8:449:8 | ref arg b | TAINT |
| string.cpp:449:32:449:46 | call to source | string.cpp:449:10:449:15 | call to insert | TAINT |
@@ -4396,6 +4400,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| string.cpp:459:17:459:17 | c | string.cpp:459:19:459:21 | call to end | TAINT |
| string.cpp:459:17:459:17 | ref arg c | string.cpp:459:8:459:8 | c | |
| string.cpp:459:17:459:17 | ref arg c | string.cpp:460:8:460:8 | c | |
| string.cpp:459:17:459:23 | call to iterator | string.cpp:459:8:459:8 | ref arg c | TAINT |
| string.cpp:459:17:459:23 | call to iterator | string.cpp:459:10:459:15 | call to insert | TAINT |
| string.cpp:459:19:459:21 | call to end | string.cpp:459:17:459:23 | call to iterator | TAINT |
| string.cpp:459:26:459:27 | ref arg s1 | string.cpp:459:38:459:39 | s1 | |
| string.cpp:459:26:459:27 | ref arg s1 | string.cpp:465:28:465:29 | s1 | |
@@ -4413,6 +4419,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| string.cpp:462:17:462:17 | d | string.cpp:462:19:462:21 | call to end | TAINT |
| string.cpp:462:17:462:17 | ref arg d | string.cpp:462:8:462:8 | d | |
| string.cpp:462:17:462:17 | ref arg d | string.cpp:463:8:463:8 | d | |
| string.cpp:462:17:462:23 | call to iterator | string.cpp:462:8:462:8 | ref arg d | TAINT |
| string.cpp:462:17:462:23 | call to iterator | string.cpp:462:10:462:15 | call to insert | TAINT |
| string.cpp:462:19:462:21 | call to end | string.cpp:462:17:462:23 | call to iterator | TAINT |
| string.cpp:462:26:462:27 | ref arg s2 | string.cpp:462:38:462:39 | s2 | |
| string.cpp:462:26:462:27 | ref arg s2 | string.cpp:465:8:465:9 | s2 | |
@@ -4432,6 +4440,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| string.cpp:465:18:465:19 | ref arg s2 | string.cpp:465:8:465:9 | s2 | |
| string.cpp:465:18:465:19 | ref arg s2 | string.cpp:466:8:466:9 | s2 | |
| string.cpp:465:18:465:19 | s2 | string.cpp:465:21:465:23 | call to end | TAINT |
| string.cpp:465:18:465:25 | call to iterator | string.cpp:465:8:465:9 | ref arg s2 | TAINT |
| string.cpp:465:18:465:25 | call to iterator | string.cpp:465:11:465:16 | call to insert | TAINT |
| string.cpp:465:21:465:23 | call to end | string.cpp:465:18:465:25 | call to iterator | TAINT |
| string.cpp:465:28:465:29 | ref arg s1 | string.cpp:465:40:465:41 | s1 | |
| string.cpp:465:28:465:29 | s1 | string.cpp:465:31:465:35 | call to begin | TAINT |
@@ -6684,7 +6694,6 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:17:21:17:33 | call to vector | vector.cpp:23:55:23:55 | v | |
| vector.cpp:17:21:17:33 | call to vector | vector.cpp:27:15:27:15 | v | |
| vector.cpp:17:21:17:33 | call to vector | vector.cpp:35:1:35:1 | v | |
| vector.cpp:17:26:17:32 | source1 | vector.cpp:17:21:17:33 | call to vector | TAINT |
| vector.cpp:19:14:19:14 | (__begin) | vector.cpp:19:14:19:14 | call to operator* | TAINT |
| vector.cpp:19:14:19:14 | (__begin) | vector.cpp:19:14:19:14 | call to operator++ | |
| vector.cpp:19:14:19:14 | (__end) | vector.cpp:19:14:19:14 | call to iterator | |
@@ -6746,7 +6755,6 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:27:15:27:15 | v | vector.cpp:27:15:27:15 | call to operator* | TAINT |
| vector.cpp:31:33:31:45 | call to vector | vector.cpp:32:21:32:27 | const_v | |
| vector.cpp:31:33:31:45 | call to vector | vector.cpp:35:1:35:1 | const_v | |
| vector.cpp:31:38:31:44 | source1 | vector.cpp:31:33:31:45 | call to vector | TAINT |
| vector.cpp:32:21:32:21 | (__begin) | vector.cpp:32:21:32:21 | call to operator* | TAINT |
| vector.cpp:32:21:32:21 | (__begin) | vector.cpp:32:21:32:21 | call to operator++ | |
| vector.cpp:32:21:32:21 | (__range) | vector.cpp:32:21:32:21 | call to begin | TAINT |
@@ -6837,9 +6845,7 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:40:2:40:3 | ref arg v1 | vector.cpp:48:7:48:8 | v1 | |
| vector.cpp:40:2:40:3 | ref arg v1 | vector.cpp:49:7:49:8 | v1 | |
| vector.cpp:40:2:40:3 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:40:2:40:3 | v1 | vector.cpp:40:4:40:4 | call to operator[] | TAINT |
| vector.cpp:40:2:40:10 | ... = ... | vector.cpp:40:4:40:4 | call to operator[] [post update] | |
| vector.cpp:40:4:40:4 | call to operator[] [post update] | vector.cpp:40:2:40:3 | ref arg v1 | TAINT |
| vector.cpp:40:10:40:10 | 0 | vector.cpp:40:2:40:10 | ... = ... | |
| vector.cpp:41:2:41:3 | ref arg v1 | vector.cpp:42:2:42:3 | v1 | |
| vector.cpp:41:2:41:3 | ref arg v1 | vector.cpp:43:2:43:3 | v1 | |
@@ -6850,9 +6856,7 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:41:2:41:3 | ref arg v1 | vector.cpp:48:7:48:8 | v1 | |
| vector.cpp:41:2:41:3 | ref arg v1 | vector.cpp:49:7:49:8 | v1 | |
| vector.cpp:41:2:41:3 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:41:2:41:3 | v1 | vector.cpp:41:4:41:4 | call to operator[] | TAINT |
| vector.cpp:41:2:41:10 | ... = ... | vector.cpp:41:4:41:4 | call to operator[] [post update] | |
| vector.cpp:41:4:41:4 | call to operator[] [post update] | vector.cpp:41:2:41:3 | ref arg v1 | TAINT |
| vector.cpp:41:10:41:10 | 0 | vector.cpp:41:2:41:10 | ... = ... | |
| vector.cpp:42:2:42:3 | ref arg v1 | vector.cpp:43:2:43:3 | v1 | |
| vector.cpp:42:2:42:3 | ref arg v1 | vector.cpp:44:7:44:8 | v1 | |
@@ -6862,9 +6866,7 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:42:2:42:3 | ref arg v1 | vector.cpp:48:7:48:8 | v1 | |
| vector.cpp:42:2:42:3 | ref arg v1 | vector.cpp:49:7:49:8 | v1 | |
| vector.cpp:42:2:42:3 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:42:2:42:3 | v1 | vector.cpp:42:4:42:4 | call to operator[] | TAINT |
| vector.cpp:42:2:42:10 | ... = ... | vector.cpp:42:4:42:4 | call to operator[] [post update] | |
| vector.cpp:42:4:42:4 | call to operator[] [post update] | vector.cpp:42:2:42:3 | ref arg v1 | TAINT |
| vector.cpp:42:10:42:10 | 0 | vector.cpp:42:2:42:10 | ... = ... | |
| vector.cpp:43:2:43:3 | ref arg v1 | vector.cpp:44:7:44:8 | v1 | |
| vector.cpp:43:2:43:3 | ref arg v1 | vector.cpp:45:7:45:8 | v1 | |
@@ -6873,7 +6875,6 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:43:2:43:3 | ref arg v1 | vector.cpp:48:7:48:8 | v1 | |
| vector.cpp:43:2:43:3 | ref arg v1 | vector.cpp:49:7:49:8 | v1 | |
| vector.cpp:43:2:43:3 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:43:15:43:15 | 1 | vector.cpp:43:2:43:3 | ref arg v1 | TAINT |
| vector.cpp:44:7:44:8 | ref arg v1 | vector.cpp:45:7:45:8 | v1 | |
| vector.cpp:44:7:44:8 | ref arg v1 | vector.cpp:46:7:46:8 | v1 | |
| vector.cpp:44:7:44:8 | ref arg v1 | vector.cpp:47:7:47:8 | v1 | |
@@ -6885,30 +6886,23 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:45:7:45:8 | ref arg v1 | vector.cpp:48:7:48:8 | v1 | |
| vector.cpp:45:7:45:8 | ref arg v1 | vector.cpp:49:7:49:8 | v1 | |
| vector.cpp:45:7:45:8 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:45:7:45:8 | v1 | vector.cpp:45:9:45:9 | call to operator[] | TAINT |
| vector.cpp:46:7:46:8 | ref arg v1 | vector.cpp:47:7:47:8 | v1 | |
| vector.cpp:46:7:46:8 | ref arg v1 | vector.cpp:48:7:48:8 | v1 | |
| vector.cpp:46:7:46:8 | ref arg v1 | vector.cpp:49:7:49:8 | v1 | |
| vector.cpp:46:7:46:8 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:46:7:46:8 | v1 | vector.cpp:46:9:46:9 | call to operator[] | TAINT |
| vector.cpp:47:7:47:8 | ref arg v1 | vector.cpp:48:7:48:8 | v1 | |
| vector.cpp:47:7:47:8 | ref arg v1 | vector.cpp:49:7:49:8 | v1 | |
| vector.cpp:47:7:47:8 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:47:7:47:8 | v1 | vector.cpp:47:9:47:9 | call to operator[] | TAINT |
| vector.cpp:48:7:48:8 | ref arg v1 | vector.cpp:49:7:49:8 | v1 | |
| vector.cpp:48:7:48:8 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:48:7:48:8 | v1 | vector.cpp:48:10:48:14 | call to front | TAINT |
| vector.cpp:49:7:49:8 | ref arg v1 | vector.cpp:101:1:101:1 | v1 | |
| vector.cpp:49:7:49:8 | v1 | vector.cpp:49:10:49:13 | call to back | TAINT |
| vector.cpp:51:2:51:3 | ref arg v2 | vector.cpp:52:7:52:8 | v2 | |
| vector.cpp:51:2:51:3 | ref arg v2 | vector.cpp:53:7:53:8 | v2 | |
| vector.cpp:51:2:51:3 | ref arg v2 | vector.cpp:54:7:54:8 | v2 | |
| vector.cpp:51:2:51:3 | ref arg v2 | vector.cpp:55:7:55:8 | v2 | |
| vector.cpp:51:2:51:3 | ref arg v2 | vector.cpp:57:7:57:8 | v2 | |
| vector.cpp:51:2:51:3 | ref arg v2 | vector.cpp:101:1:101:1 | v2 | |
| vector.cpp:51:2:51:3 | v2 | vector.cpp:51:4:51:4 | call to operator[] | TAINT |
| vector.cpp:51:2:51:17 | ... = ... | vector.cpp:51:4:51:4 | call to operator[] [post update] | |
| vector.cpp:51:4:51:4 | call to operator[] [post update] | vector.cpp:51:2:51:3 | ref arg v2 | TAINT |
| vector.cpp:51:10:51:15 | call to source | vector.cpp:51:2:51:17 | ... = ... | |
| vector.cpp:52:7:52:8 | ref arg v2 | vector.cpp:53:7:53:8 | v2 | |
| vector.cpp:52:7:52:8 | ref arg v2 | vector.cpp:54:7:54:8 | v2 | |
@@ -6919,14 +6913,11 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:53:7:53:8 | ref arg v2 | vector.cpp:55:7:55:8 | v2 | |
| vector.cpp:53:7:53:8 | ref arg v2 | vector.cpp:57:7:57:8 | v2 | |
| vector.cpp:53:7:53:8 | ref arg v2 | vector.cpp:101:1:101:1 | v2 | |
| vector.cpp:53:7:53:8 | v2 | vector.cpp:53:9:53:9 | call to operator[] | TAINT |
| vector.cpp:54:7:54:8 | ref arg v2 | vector.cpp:55:7:55:8 | v2 | |
| vector.cpp:54:7:54:8 | ref arg v2 | vector.cpp:57:7:57:8 | v2 | |
| vector.cpp:54:7:54:8 | ref arg v2 | vector.cpp:101:1:101:1 | v2 | |
| vector.cpp:54:7:54:8 | v2 | vector.cpp:54:9:54:9 | call to operator[] | TAINT |
| vector.cpp:55:7:55:8 | ref arg v2 | vector.cpp:57:7:57:8 | v2 | |
| vector.cpp:55:7:55:8 | ref arg v2 | vector.cpp:101:1:101:1 | v2 | |
| vector.cpp:55:7:55:8 | v2 | vector.cpp:55:9:55:9 | call to operator[] | TAINT |
| vector.cpp:57:2:57:3 | ref arg v3 | vector.cpp:58:7:58:8 | v3 | |
| vector.cpp:57:2:57:3 | ref arg v3 | vector.cpp:59:7:59:8 | v3 | |
| vector.cpp:57:2:57:3 | ref arg v3 | vector.cpp:60:7:60:8 | v3 | |
@@ -6941,20 +6932,15 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:59:7:59:8 | ref arg v3 | vector.cpp:60:7:60:8 | v3 | |
| vector.cpp:59:7:59:8 | ref arg v3 | vector.cpp:61:7:61:8 | v3 | |
| vector.cpp:59:7:59:8 | ref arg v3 | vector.cpp:101:1:101:1 | v3 | |
| vector.cpp:59:7:59:8 | v3 | vector.cpp:59:9:59:9 | call to operator[] | TAINT |
| vector.cpp:60:7:60:8 | ref arg v3 | vector.cpp:61:7:61:8 | v3 | |
| vector.cpp:60:7:60:8 | ref arg v3 | vector.cpp:101:1:101:1 | v3 | |
| vector.cpp:60:7:60:8 | v3 | vector.cpp:60:9:60:9 | call to operator[] | TAINT |
| vector.cpp:61:7:61:8 | ref arg v3 | vector.cpp:101:1:101:1 | v3 | |
| vector.cpp:61:7:61:8 | v3 | vector.cpp:61:9:61:9 | call to operator[] | TAINT |
| vector.cpp:63:2:63:3 | ref arg v4 | vector.cpp:64:7:64:8 | v4 | |
| vector.cpp:63:2:63:3 | ref arg v4 | vector.cpp:65:7:65:8 | v4 | |
| vector.cpp:63:2:63:3 | ref arg v4 | vector.cpp:66:7:66:8 | v4 | |
| vector.cpp:63:2:63:3 | ref arg v4 | vector.cpp:67:7:67:8 | v4 | |
| vector.cpp:63:2:63:3 | ref arg v4 | vector.cpp:101:1:101:1 | v4 | |
| vector.cpp:63:2:63:3 | v4 | vector.cpp:63:4:63:4 | call to operator[] | TAINT |
| vector.cpp:63:2:63:17 | ... = ... | vector.cpp:63:4:63:4 | call to operator[] [post update] | |
| vector.cpp:63:4:63:4 | call to operator[] [post update] | vector.cpp:63:2:63:3 | ref arg v4 | TAINT |
| vector.cpp:63:10:63:15 | call to source | vector.cpp:63:2:63:17 | ... = ... | |
| vector.cpp:64:7:64:8 | ref arg v4 | vector.cpp:65:7:65:8 | v4 | |
| vector.cpp:64:7:64:8 | ref arg v4 | vector.cpp:66:7:66:8 | v4 | |
@@ -6963,39 +6949,30 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:65:7:65:8 | ref arg v4 | vector.cpp:66:7:66:8 | v4 | |
| vector.cpp:65:7:65:8 | ref arg v4 | vector.cpp:67:7:67:8 | v4 | |
| vector.cpp:65:7:65:8 | ref arg v4 | vector.cpp:101:1:101:1 | v4 | |
| vector.cpp:65:7:65:8 | v4 | vector.cpp:65:9:65:9 | call to operator[] | TAINT |
| vector.cpp:66:7:66:8 | ref arg v4 | vector.cpp:67:7:67:8 | v4 | |
| vector.cpp:66:7:66:8 | ref arg v4 | vector.cpp:101:1:101:1 | v4 | |
| vector.cpp:66:7:66:8 | v4 | vector.cpp:66:9:66:9 | call to operator[] | TAINT |
| vector.cpp:67:7:67:8 | ref arg v4 | vector.cpp:101:1:101:1 | v4 | |
| vector.cpp:67:7:67:8 | v4 | vector.cpp:67:9:67:9 | call to operator[] | TAINT |
| vector.cpp:69:2:69:3 | ref arg v5 | vector.cpp:70:7:70:8 | v5 | |
| vector.cpp:69:2:69:3 | ref arg v5 | vector.cpp:71:7:71:8 | v5 | |
| vector.cpp:69:2:69:3 | ref arg v5 | vector.cpp:72:7:72:8 | v5 | |
| vector.cpp:69:2:69:3 | ref arg v5 | vector.cpp:101:1:101:1 | v5 | |
| vector.cpp:69:15:69:20 | call to source | vector.cpp:69:2:69:3 | ref arg v5 | TAINT |
| vector.cpp:70:7:70:8 | ref arg v5 | vector.cpp:71:7:71:8 | v5 | |
| vector.cpp:70:7:70:8 | ref arg v5 | vector.cpp:72:7:72:8 | v5 | |
| vector.cpp:70:7:70:8 | ref arg v5 | vector.cpp:101:1:101:1 | v5 | |
| vector.cpp:71:7:71:8 | ref arg v5 | vector.cpp:72:7:72:8 | v5 | |
| vector.cpp:71:7:71:8 | ref arg v5 | vector.cpp:101:1:101:1 | v5 | |
| vector.cpp:71:7:71:8 | v5 | vector.cpp:71:10:71:14 | call to front | TAINT |
| vector.cpp:72:7:72:8 | ref arg v5 | vector.cpp:101:1:101:1 | v5 | |
| vector.cpp:72:7:72:8 | v5 | vector.cpp:72:10:72:13 | call to back | TAINT |
| vector.cpp:74:2:74:3 | ref arg v6 | vector.cpp:75:7:75:8 | v6 | |
| vector.cpp:74:2:74:3 | ref arg v6 | vector.cpp:76:7:76:8 | v6 | |
| vector.cpp:74:2:74:3 | ref arg v6 | vector.cpp:101:1:101:1 | v6 | |
| vector.cpp:74:2:74:3 | v6 | vector.cpp:74:5:74:8 | call to data | TAINT |
| vector.cpp:74:2:74:13 | access to array [post update] | vector.cpp:74:5:74:8 | call to data [inner post update] | |
| vector.cpp:74:2:74:24 | ... = ... | vector.cpp:74:2:74:13 | access to array [post update] | |
| vector.cpp:74:5:74:8 | call to data | vector.cpp:74:2:74:13 | access to array | TAINT |
| vector.cpp:74:5:74:8 | call to data [inner post update] | vector.cpp:74:2:74:3 | ref arg v6 | TAINT |
| vector.cpp:74:12:74:12 | 2 | vector.cpp:74:2:74:13 | access to array | TAINT |
| vector.cpp:74:17:74:22 | call to source | vector.cpp:74:2:74:24 | ... = ... | |
| vector.cpp:75:7:75:8 | ref arg v6 | vector.cpp:76:7:76:8 | v6 | |
| vector.cpp:75:7:75:8 | ref arg v6 | vector.cpp:101:1:101:1 | v6 | |
| vector.cpp:76:7:76:8 | ref arg v6 | vector.cpp:101:1:101:1 | v6 | |
| vector.cpp:76:7:76:8 | v6 | vector.cpp:76:10:76:13 | call to data | TAINT |
| vector.cpp:76:10:76:13 | call to data | vector.cpp:76:7:76:18 | access to array | TAINT |
| vector.cpp:76:17:76:17 | 2 | vector.cpp:76:7:76:18 | access to array | TAINT |
| vector.cpp:80:40:80:50 | call to iterator | vector.cpp:81:13:81:14 | it | |
@@ -7010,17 +6987,12 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:81:3:81:4 | ref arg v7 | vector.cpp:84:7:84:8 | v7 | |
| vector.cpp:81:3:81:4 | ref arg v7 | vector.cpp:85:7:85:8 | v7 | |
| vector.cpp:81:3:81:4 | ref arg v7 | vector.cpp:101:1:101:1 | v7 | |
| vector.cpp:81:3:81:4 | v7 | vector.cpp:81:6:81:11 | call to insert | TAINT |
| vector.cpp:81:17:81:22 | call to source | vector.cpp:81:3:81:4 | ref arg v7 | TAINT |
| vector.cpp:81:17:81:22 | call to source | vector.cpp:81:6:81:11 | call to insert | TAINT |
| vector.cpp:83:7:83:8 | ref arg v7 | vector.cpp:84:7:84:8 | v7 | |
| vector.cpp:83:7:83:8 | ref arg v7 | vector.cpp:85:7:85:8 | v7 | |
| vector.cpp:83:7:83:8 | ref arg v7 | vector.cpp:101:1:101:1 | v7 | |
| vector.cpp:84:7:84:8 | ref arg v7 | vector.cpp:85:7:85:8 | v7 | |
| vector.cpp:84:7:84:8 | ref arg v7 | vector.cpp:101:1:101:1 | v7 | |
| vector.cpp:84:7:84:8 | v7 | vector.cpp:84:10:84:14 | call to front | TAINT |
| vector.cpp:85:7:85:8 | ref arg v7 | vector.cpp:101:1:101:1 | v7 | |
| vector.cpp:85:7:85:8 | v7 | vector.cpp:85:10:85:13 | call to back | TAINT |
| vector.cpp:88:33:88:34 | v8 | vector.cpp:89:41:89:43 | v8c | |
| vector.cpp:89:41:89:43 | v8c | vector.cpp:89:45:89:49 | call to begin | TAINT |
| vector.cpp:89:45:89:49 | call to begin | vector.cpp:90:13:90:14 | it | |
@@ -7028,23 +7000,18 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:90:3:90:4 | ref arg v8 | vector.cpp:93:7:93:8 | v8 | |
| vector.cpp:90:3:90:4 | ref arg v8 | vector.cpp:94:7:94:8 | v8 | |
| vector.cpp:90:3:90:4 | ref arg v8 | vector.cpp:101:1:101:1 | v8 | |
| vector.cpp:90:3:90:4 | v8 | vector.cpp:90:6:90:11 | call to insert | TAINT |
| vector.cpp:92:7:92:8 | ref arg v8 | vector.cpp:93:7:93:8 | v8 | |
| vector.cpp:92:7:92:8 | ref arg v8 | vector.cpp:94:7:94:8 | v8 | |
| vector.cpp:92:7:92:8 | ref arg v8 | vector.cpp:101:1:101:1 | v8 | |
| vector.cpp:93:7:93:8 | ref arg v8 | vector.cpp:94:7:94:8 | v8 | |
| vector.cpp:93:7:93:8 | ref arg v8 | vector.cpp:101:1:101:1 | v8 | |
| vector.cpp:93:7:93:8 | v8 | vector.cpp:93:10:93:14 | call to front | TAINT |
| vector.cpp:94:7:94:8 | ref arg v8 | vector.cpp:101:1:101:1 | v8 | |
| vector.cpp:94:7:94:8 | v8 | vector.cpp:94:10:94:13 | call to back | TAINT |
| vector.cpp:96:2:96:3 | ref arg v9 | vector.cpp:97:7:97:8 | v9 | |
| vector.cpp:96:2:96:3 | ref arg v9 | vector.cpp:98:7:98:8 | v9 | |
| vector.cpp:96:2:96:3 | ref arg v9 | vector.cpp:99:7:99:8 | v9 | |
| vector.cpp:96:2:96:3 | ref arg v9 | vector.cpp:100:7:100:8 | v9 | |
| vector.cpp:96:2:96:3 | ref arg v9 | vector.cpp:101:1:101:1 | v9 | |
| vector.cpp:96:2:96:3 | v9 | vector.cpp:96:5:96:6 | call to at | TAINT |
| vector.cpp:96:2:96:20 | ... = ... | vector.cpp:96:5:96:6 | call to at [post update] | |
| vector.cpp:96:5:96:6 | call to at [post update] | vector.cpp:96:2:96:3 | ref arg v9 | TAINT |
| vector.cpp:96:13:96:18 | call to source | vector.cpp:96:2:96:20 | ... = ... | |
| vector.cpp:97:7:97:8 | ref arg v9 | vector.cpp:98:7:98:8 | v9 | |
| vector.cpp:97:7:97:8 | ref arg v9 | vector.cpp:99:7:99:8 | v9 | |
@@ -7053,12 +7020,9 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:98:7:98:8 | ref arg v9 | vector.cpp:99:7:99:8 | v9 | |
| vector.cpp:98:7:98:8 | ref arg v9 | vector.cpp:100:7:100:8 | v9 | |
| vector.cpp:98:7:98:8 | ref arg v9 | vector.cpp:101:1:101:1 | v9 | |
| vector.cpp:98:7:98:8 | v9 | vector.cpp:98:10:98:11 | call to at | TAINT |
| vector.cpp:99:7:99:8 | ref arg v9 | vector.cpp:100:7:100:8 | v9 | |
| vector.cpp:99:7:99:8 | ref arg v9 | vector.cpp:101:1:101:1 | v9 | |
| vector.cpp:99:7:99:8 | v9 | vector.cpp:99:10:99:11 | call to at | TAINT |
| vector.cpp:100:7:100:8 | ref arg v9 | vector.cpp:101:1:101:1 | v9 | |
| vector.cpp:100:7:100:8 | v9 | vector.cpp:100:10:100:11 | call to at | TAINT |
| vector.cpp:104:22:104:24 | call to vector | vector.cpp:106:2:106:3 | v1 | |
| vector.cpp:104:22:104:24 | call to vector | vector.cpp:109:7:109:8 | v1 | |
| vector.cpp:104:22:104:24 | call to vector | vector.cpp:114:2:114:3 | v1 | |
@@ -7081,12 +7045,10 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:106:2:106:3 | ref arg v1 | vector.cpp:114:2:114:3 | v1 | |
| vector.cpp:106:2:106:3 | ref arg v1 | vector.cpp:117:7:117:8 | v1 | |
| vector.cpp:106:2:106:3 | ref arg v1 | vector.cpp:121:1:121:1 | v1 | |
| vector.cpp:106:15:106:20 | call to source | vector.cpp:106:2:106:3 | ref arg v1 | TAINT |
| vector.cpp:107:2:107:3 | ref arg v4 | vector.cpp:112:7:112:8 | v4 | |
| vector.cpp:107:2:107:3 | ref arg v4 | vector.cpp:115:10:115:11 | v4 | |
| vector.cpp:107:2:107:3 | ref arg v4 | vector.cpp:120:7:120:8 | v4 | |
| vector.cpp:107:2:107:3 | ref arg v4 | vector.cpp:121:1:121:1 | v4 | |
| vector.cpp:107:15:107:20 | call to source | vector.cpp:107:2:107:3 | ref arg v4 | TAINT |
| vector.cpp:109:7:109:8 | ref arg v1 | vector.cpp:114:2:114:3 | v1 | |
| vector.cpp:109:7:109:8 | ref arg v1 | vector.cpp:117:7:117:8 | v1 | |
| vector.cpp:109:7:109:8 | ref arg v1 | vector.cpp:121:1:121:1 | v1 | |
@@ -7139,18 +7101,15 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:126:2:126:3 | ref arg v1 | vector.cpp:135:2:135:3 | v1 | |
| vector.cpp:126:2:126:3 | ref arg v1 | vector.cpp:139:7:139:8 | v1 | |
| vector.cpp:126:2:126:3 | ref arg v1 | vector.cpp:143:1:143:1 | v1 | |
| vector.cpp:126:15:126:20 | call to source | vector.cpp:126:2:126:3 | ref arg v1 | TAINT |
| vector.cpp:127:2:127:3 | ref arg v2 | vector.cpp:131:7:131:8 | v2 | |
| vector.cpp:127:2:127:3 | ref arg v2 | vector.cpp:136:2:136:3 | v2 | |
| vector.cpp:127:2:127:3 | ref arg v2 | vector.cpp:136:7:136:8 | v2 | |
| vector.cpp:127:2:127:3 | ref arg v2 | vector.cpp:140:7:140:8 | v2 | |
| vector.cpp:127:2:127:3 | ref arg v2 | vector.cpp:143:1:143:1 | v2 | |
| vector.cpp:127:15:127:20 | call to source | vector.cpp:127:2:127:3 | ref arg v2 | TAINT |
| vector.cpp:128:2:128:3 | ref arg v3 | vector.cpp:132:7:132:8 | v3 | |
| vector.cpp:128:2:128:3 | ref arg v3 | vector.cpp:137:2:137:3 | v3 | |
| vector.cpp:128:2:128:3 | ref arg v3 | vector.cpp:141:7:141:8 | v3 | |
| vector.cpp:128:2:128:3 | ref arg v3 | vector.cpp:143:1:143:1 | v3 | |
| vector.cpp:128:15:128:20 | call to source | vector.cpp:128:2:128:3 | ref arg v3 | TAINT |
| vector.cpp:130:7:130:8 | ref arg v1 | vector.cpp:135:2:135:3 | v1 | |
| vector.cpp:130:7:130:8 | ref arg v1 | vector.cpp:139:7:139:8 | v1 | |
| vector.cpp:130:7:130:8 | ref arg v1 | vector.cpp:143:1:143:1 | v1 | |
@@ -7210,31 +7169,18 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:166:37:166:39 | call to vector | vector.cpp:170:3:170:4 | bb | |
| vector.cpp:166:37:166:39 | call to vector | vector.cpp:171:8:171:9 | bb | |
| vector.cpp:166:37:166:39 | call to vector | vector.cpp:172:2:172:2 | bb | |
| vector.cpp:168:3:168:4 | bb | vector.cpp:168:5:168:5 | call to operator[] | TAINT |
| vector.cpp:168:3:168:4 | ref arg bb | vector.cpp:169:8:169:9 | bb | |
| vector.cpp:168:3:168:4 | ref arg bb | vector.cpp:170:3:170:4 | bb | |
| vector.cpp:168:3:168:4 | ref arg bb | vector.cpp:171:8:171:9 | bb | |
| vector.cpp:168:3:168:4 | ref arg bb | vector.cpp:172:2:172:2 | bb | |
| vector.cpp:168:5:168:5 | ref arg call to operator[] | vector.cpp:168:3:168:4 | ref arg bb | TAINT |
| vector.cpp:168:19:168:19 | 0 | vector.cpp:168:5:168:5 | ref arg call to operator[] | TAINT |
| vector.cpp:169:8:169:9 | bb | vector.cpp:169:10:169:10 | call to operator[] | TAINT |
| vector.cpp:169:8:169:9 | ref arg bb | vector.cpp:170:3:170:4 | bb | |
| vector.cpp:169:8:169:9 | ref arg bb | vector.cpp:171:8:171:9 | bb | |
| vector.cpp:169:8:169:9 | ref arg bb | vector.cpp:172:2:172:2 | bb | |
| vector.cpp:169:10:169:10 | call to operator[] | vector.cpp:169:13:169:13 | call to operator[] | TAINT |
| vector.cpp:169:10:169:10 | ref arg call to operator[] | vector.cpp:169:8:169:9 | ref arg bb | TAINT |
| vector.cpp:170:3:170:4 | bb | vector.cpp:170:5:170:5 | call to operator[] | TAINT |
| vector.cpp:170:3:170:4 | ref arg bb | vector.cpp:171:8:171:9 | bb | |
| vector.cpp:170:3:170:4 | ref arg bb | vector.cpp:172:2:172:2 | bb | |
| vector.cpp:170:3:170:21 | ... = ... | vector.cpp:170:8:170:8 | call to operator[] [post update] | |
| vector.cpp:170:5:170:5 | call to operator[] | vector.cpp:170:8:170:8 | call to operator[] | TAINT |
| vector.cpp:170:5:170:5 | ref arg call to operator[] | vector.cpp:170:3:170:4 | ref arg bb | TAINT |
| vector.cpp:170:8:170:8 | call to operator[] [post update] | vector.cpp:170:5:170:5 | ref arg call to operator[] | TAINT |
| vector.cpp:170:14:170:19 | call to source | vector.cpp:170:3:170:21 | ... = ... | |
| vector.cpp:171:8:171:9 | bb | vector.cpp:171:10:171:10 | call to operator[] | TAINT |
| vector.cpp:171:8:171:9 | ref arg bb | vector.cpp:172:2:172:2 | bb | |
| vector.cpp:171:10:171:10 | call to operator[] | vector.cpp:171:13:171:13 | call to operator[] | TAINT |
| vector.cpp:171:10:171:10 | ref arg call to operator[] | vector.cpp:171:8:171:9 | ref arg bb | TAINT |
| vector.cpp:175:20:175:21 | call to vector | vector.cpp:175:20:175:21 | {...} | TAINT |
| vector.cpp:175:20:175:21 | {...} | vector.cpp:177:3:177:4 | cc | |
| vector.cpp:175:20:175:21 | {...} | vector.cpp:178:8:178:9 | cc | |
@@ -7248,25 +7194,20 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:177:3:177:7 | ref arg access to array | vector.cpp:180:8:180:9 | cc | |
| vector.cpp:177:3:177:7 | ref arg access to array | vector.cpp:181:2:181:2 | cc | |
| vector.cpp:177:6:177:6 | 0 | vector.cpp:177:3:177:7 | access to array | TAINT |
| vector.cpp:177:19:177:19 | 0 | vector.cpp:177:3:177:7 | ref arg access to array | TAINT |
| vector.cpp:178:8:178:9 | cc | vector.cpp:178:8:178:12 | access to array | |
| vector.cpp:178:8:178:12 | access to array | vector.cpp:178:13:178:13 | call to operator[] | TAINT |
| vector.cpp:178:8:178:12 | ref arg access to array | vector.cpp:178:8:178:9 | cc [inner post update] | |
| vector.cpp:178:8:178:12 | ref arg access to array | vector.cpp:179:3:179:4 | cc | |
| vector.cpp:178:8:178:12 | ref arg access to array | vector.cpp:180:8:180:9 | cc | |
| vector.cpp:178:8:178:12 | ref arg access to array | vector.cpp:181:2:181:2 | cc | |
| vector.cpp:178:11:178:11 | 0 | vector.cpp:178:8:178:12 | access to array | TAINT |
| vector.cpp:179:3:179:4 | cc | vector.cpp:179:3:179:7 | access to array | |
| vector.cpp:179:3:179:7 | access to array | vector.cpp:179:8:179:8 | call to operator[] | TAINT |
| vector.cpp:179:3:179:7 | ref arg access to array | vector.cpp:179:3:179:4 | cc [inner post update] | |
| vector.cpp:179:3:179:7 | ref arg access to array | vector.cpp:180:8:180:9 | cc | |
| vector.cpp:179:3:179:7 | ref arg access to array | vector.cpp:181:2:181:2 | cc | |
| vector.cpp:179:3:179:21 | ... = ... | vector.cpp:179:8:179:8 | call to operator[] [post update] | |
| vector.cpp:179:6:179:6 | 0 | vector.cpp:179:3:179:7 | access to array | TAINT |
| vector.cpp:179:8:179:8 | call to operator[] [post update] | vector.cpp:179:3:179:7 | ref arg access to array | TAINT |
| vector.cpp:179:14:179:19 | call to source | vector.cpp:179:3:179:21 | ... = ... | |
| vector.cpp:180:8:180:9 | cc | vector.cpp:180:8:180:12 | access to array | |
| vector.cpp:180:8:180:12 | access to array | vector.cpp:180:13:180:13 | call to operator[] | TAINT |
| vector.cpp:180:8:180:12 | ref arg access to array | vector.cpp:180:8:180:9 | cc [inner post update] | |
| vector.cpp:180:8:180:12 | ref arg access to array | vector.cpp:181:2:181:2 | cc | |
| vector.cpp:180:11:180:11 | 0 | vector.cpp:180:8:180:12 | access to array | TAINT |
@@ -7284,29 +7225,22 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:191:8:191:9 | dd | |
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
| vector.cpp:187:3:187:4 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
| vector.cpp:187:16:187:17 | mp | vector.cpp:187:3:187:4 | ref arg dd | TAINT |
| vector.cpp:188:8:188:9 | dd | vector.cpp:188:10:188:10 | call to operator[] | TAINT |
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:189:8:189:9 | dd | |
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:190:3:190:4 | dd | |
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:191:8:191:9 | dd | |
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
| vector.cpp:188:8:188:9 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
| vector.cpp:189:8:189:9 | dd | vector.cpp:189:10:189:10 | call to operator[] | TAINT |
| vector.cpp:189:8:189:9 | ref arg dd | vector.cpp:190:3:190:4 | dd | |
| vector.cpp:189:8:189:9 | ref arg dd | vector.cpp:191:8:191:9 | dd | |
| vector.cpp:189:8:189:9 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
| vector.cpp:189:8:189:9 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
| vector.cpp:190:3:190:4 | dd | vector.cpp:190:5:190:5 | call to operator[] | TAINT |
| vector.cpp:190:3:190:4 | ref arg dd | vector.cpp:191:8:191:9 | dd | |
| vector.cpp:190:3:190:4 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
| vector.cpp:190:3:190:4 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
| vector.cpp:190:3:190:20 | ... = ... | vector.cpp:190:9:190:9 | a [post update] | |
| vector.cpp:190:5:190:5 | call to operator[] [post update] | vector.cpp:190:3:190:4 | ref arg dd | TAINT |
| vector.cpp:190:13:190:18 | call to source | vector.cpp:190:3:190:20 | ... = ... | |
| vector.cpp:191:8:191:9 | dd | vector.cpp:191:10:191:10 | call to operator[] | TAINT |
| vector.cpp:191:8:191:9 | ref arg dd | vector.cpp:192:8:192:9 | dd | |
| vector.cpp:191:8:191:9 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
| vector.cpp:192:8:192:9 | dd | vector.cpp:192:10:192:10 | call to operator[] | TAINT |
| vector.cpp:192:8:192:9 | ref arg dd | vector.cpp:193:2:193:2 | dd | |
| vector.cpp:196:21:196:22 | call to MyVectorContainer | vector.cpp:198:3:198:4 | ee | |
| vector.cpp:196:21:196:22 | call to MyVectorContainer | vector.cpp:199:8:199:9 | ee | |
@@ -7320,22 +7254,17 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:198:6:198:7 | ref arg vs | vector.cpp:199:11:199:12 | vs | |
| vector.cpp:198:6:198:7 | ref arg vs | vector.cpp:200:6:200:7 | vs | |
| vector.cpp:198:6:198:7 | ref arg vs | vector.cpp:201:11:201:12 | vs | |
| vector.cpp:198:19:198:19 | 0 | vector.cpp:198:6:198:7 | ref arg vs | TAINT |
| vector.cpp:199:8:199:9 | ee [post update] | vector.cpp:200:3:200:4 | ee | |
| vector.cpp:199:8:199:9 | ee [post update] | vector.cpp:201:8:201:9 | ee | |
| vector.cpp:199:8:199:9 | ee [post update] | vector.cpp:202:2:202:2 | ee | |
| vector.cpp:199:11:199:12 | ref arg vs | vector.cpp:200:6:200:7 | vs | |
| vector.cpp:199:11:199:12 | ref arg vs | vector.cpp:201:11:201:12 | vs | |
| vector.cpp:199:11:199:12 | vs | vector.cpp:199:13:199:13 | call to operator[] | TAINT |
| vector.cpp:200:3:200:4 | ee [post update] | vector.cpp:201:8:201:9 | ee | |
| vector.cpp:200:3:200:4 | ee [post update] | vector.cpp:202:2:202:2 | ee | |
| vector.cpp:200:3:200:21 | ... = ... | vector.cpp:200:8:200:8 | call to operator[] [post update] | |
| vector.cpp:200:6:200:7 | ref arg vs | vector.cpp:201:11:201:12 | vs | |
| vector.cpp:200:6:200:7 | vs | vector.cpp:200:8:200:8 | call to operator[] | TAINT |
| vector.cpp:200:8:200:8 | call to operator[] [post update] | vector.cpp:200:6:200:7 | ref arg vs | TAINT |
| vector.cpp:200:14:200:19 | call to source | vector.cpp:200:3:200:21 | ... = ... | |
| vector.cpp:201:8:201:9 | ee [post update] | vector.cpp:202:2:202:2 | ee | |
| vector.cpp:201:11:201:12 | vs | vector.cpp:201:13:201:13 | call to operator[] | TAINT |
| vector.cpp:205:34:205:35 | call to vector | vector.cpp:209:3:209:4 | ff | |
| vector.cpp:205:34:205:35 | call to vector | vector.cpp:210:8:210:9 | ff | |
| vector.cpp:205:34:205:35 | call to vector | vector.cpp:211:3:211:4 | ff | |
@@ -7346,30 +7275,18 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:206:21:206:23 | call to MyVectorContainer | vector.cpp:213:2:213:2 | mvc | |
| vector.cpp:208:3:208:5 | mvc [post update] | vector.cpp:209:16:209:18 | mvc | |
| vector.cpp:208:3:208:5 | mvc [post update] | vector.cpp:213:2:213:2 | mvc | |
| vector.cpp:208:20:208:20 | 0 | vector.cpp:208:7:208:8 | ref arg vs | TAINT |
| vector.cpp:209:3:209:4 | ref arg ff | vector.cpp:210:8:210:9 | ff | |
| vector.cpp:209:3:209:4 | ref arg ff | vector.cpp:211:3:211:4 | ff | |
| vector.cpp:209:3:209:4 | ref arg ff | vector.cpp:212:8:212:9 | ff | |
| vector.cpp:209:3:209:4 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
| vector.cpp:209:16:209:18 | mvc | vector.cpp:209:3:209:4 | ref arg ff | TAINT |
| vector.cpp:210:8:210:9 | ff | vector.cpp:210:10:210:10 | call to operator[] | TAINT |
| vector.cpp:210:8:210:9 | ref arg ff | vector.cpp:211:3:211:4 | ff | |
| vector.cpp:210:8:210:9 | ref arg ff | vector.cpp:212:8:212:9 | ff | |
| vector.cpp:210:8:210:9 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
| vector.cpp:210:10:210:10 | call to operator[] [post update] | vector.cpp:210:8:210:9 | ref arg ff | TAINT |
| vector.cpp:210:14:210:15 | vs | vector.cpp:210:16:210:16 | call to operator[] | TAINT |
| vector.cpp:211:3:211:4 | ff | vector.cpp:211:5:211:5 | call to operator[] | TAINT |
| vector.cpp:211:3:211:4 | ref arg ff | vector.cpp:212:8:212:9 | ff | |
| vector.cpp:211:3:211:4 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
| vector.cpp:211:3:211:24 | ... = ... | vector.cpp:211:11:211:11 | call to operator[] [post update] | |
| vector.cpp:211:5:211:5 | call to operator[] [post update] | vector.cpp:211:3:211:4 | ref arg ff | TAINT |
| vector.cpp:211:9:211:10 | vs | vector.cpp:211:11:211:11 | call to operator[] | TAINT |
| vector.cpp:211:11:211:11 | call to operator[] [post update] | vector.cpp:211:9:211:10 | ref arg vs | TAINT |
| vector.cpp:211:17:211:22 | call to source | vector.cpp:211:3:211:24 | ... = ... | |
| vector.cpp:212:8:212:9 | ff | vector.cpp:212:10:212:10 | call to operator[] | TAINT |
| vector.cpp:212:8:212:9 | ref arg ff | vector.cpp:213:2:213:2 | ff | |
| vector.cpp:212:10:212:10 | call to operator[] [post update] | vector.cpp:212:8:212:9 | ref arg ff | TAINT |
| vector.cpp:212:14:212:15 | vs | vector.cpp:212:16:212:16 | call to operator[] | TAINT |
| vector.cpp:235:19:235:20 | call to vector | vector.cpp:237:2:237:3 | v1 | |
| vector.cpp:235:19:235:20 | call to vector | vector.cpp:241:7:241:8 | v1 | |
| vector.cpp:235:19:235:20 | call to vector | vector.cpp:249:13:249:14 | v1 | |
@@ -7388,16 +7305,13 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:237:2:237:3 | ref arg v1 | vector.cpp:249:13:249:14 | v1 | |
| vector.cpp:237:2:237:3 | ref arg v1 | vector.cpp:249:25:249:26 | v1 | |
| vector.cpp:237:2:237:3 | ref arg v1 | vector.cpp:277:1:277:1 | v1 | |
| vector.cpp:237:17:237:17 | 0 | vector.cpp:237:2:237:3 | ref arg v1 | TAINT |
| vector.cpp:238:2:238:3 | ref arg v2 | vector.cpp:242:7:242:8 | v2 | |
| vector.cpp:238:2:238:3 | ref arg v2 | vector.cpp:277:1:277:1 | v2 | |
| vector.cpp:238:17:238:30 | call to source | vector.cpp:238:2:238:3 | ref arg v2 | TAINT |
| vector.cpp:239:2:239:3 | ref arg v3 | vector.cpp:243:7:243:8 | v3 | |
| vector.cpp:239:2:239:3 | ref arg v3 | vector.cpp:250:13:250:14 | v3 | |
| vector.cpp:239:2:239:3 | ref arg v3 | vector.cpp:250:25:250:26 | v3 | |
| vector.cpp:239:2:239:3 | ref arg v3 | vector.cpp:251:8:251:9 | v3 | |
| vector.cpp:239:2:239:3 | ref arg v3 | vector.cpp:277:1:277:1 | v3 | |
| vector.cpp:239:15:239:20 | call to source | vector.cpp:239:2:239:3 | ref arg v3 | TAINT |
| vector.cpp:241:7:241:8 | ref arg v1 | vector.cpp:249:13:249:14 | v1 | |
| vector.cpp:241:7:241:8 | ref arg v1 | vector.cpp:249:25:249:26 | v1 | |
| vector.cpp:241:7:241:8 | ref arg v1 | vector.cpp:277:1:277:1 | v1 | |
@@ -7420,21 +7334,17 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:249:13:249:14 | ref arg v1 | vector.cpp:249:25:249:26 | v1 | |
| vector.cpp:249:13:249:14 | ref arg v1 | vector.cpp:277:1:277:1 | v1 | |
| vector.cpp:249:13:249:14 | v1 | vector.cpp:249:16:249:20 | call to begin | TAINT |
| vector.cpp:249:16:249:20 | call to begin | vector.cpp:249:3:249:4 | ref arg v4 | TAINT |
| vector.cpp:249:25:249:26 | ref arg v1 | vector.cpp:277:1:277:1 | v1 | |
| vector.cpp:249:25:249:26 | v1 | vector.cpp:249:28:249:30 | call to end | TAINT |
| vector.cpp:249:28:249:30 | call to end | vector.cpp:249:3:249:4 | ref arg v4 | TAINT |
| vector.cpp:250:3:250:4 | ref arg v5 | vector.cpp:258:8:258:9 | v5 | |
| vector.cpp:250:3:250:4 | ref arg v5 | vector.cpp:262:2:262:2 | v5 | |
| vector.cpp:250:13:250:14 | ref arg v3 | vector.cpp:250:25:250:26 | v3 | |
| vector.cpp:250:13:250:14 | ref arg v3 | vector.cpp:251:8:251:9 | v3 | |
| vector.cpp:250:13:250:14 | ref arg v3 | vector.cpp:277:1:277:1 | v3 | |
| vector.cpp:250:13:250:14 | v3 | vector.cpp:250:16:250:20 | call to begin | TAINT |
| vector.cpp:250:16:250:20 | call to begin | vector.cpp:250:3:250:4 | ref arg v5 | TAINT |
| vector.cpp:250:25:250:26 | ref arg v3 | vector.cpp:251:8:251:9 | v3 | |
| vector.cpp:250:25:250:26 | ref arg v3 | vector.cpp:277:1:277:1 | v3 | |
| vector.cpp:250:25:250:26 | v3 | vector.cpp:250:28:250:30 | call to end | TAINT |
| vector.cpp:250:28:250:30 | call to end | vector.cpp:250:3:250:4 | ref arg v5 | TAINT |
| vector.cpp:251:8:251:9 | ref arg v3 | vector.cpp:277:1:277:1 | v3 | |
| vector.cpp:251:8:251:9 | v3 | vector.cpp:251:11:251:15 | call to begin | TAINT |
| vector.cpp:251:11:251:15 | call to begin | vector.cpp:251:3:251:17 | ... = ... | |
@@ -7455,11 +7365,9 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:254:3:254:4 | ref arg i2 | vector.cpp:260:8:260:9 | i2 | |
| vector.cpp:255:3:255:4 | ref arg v6 | vector.cpp:261:8:261:9 | v6 | |
| vector.cpp:255:3:255:4 | ref arg v6 | vector.cpp:262:2:262:2 | v6 | |
| vector.cpp:255:13:255:14 | call to iterator | vector.cpp:255:3:255:4 | ref arg v6 | TAINT |
| vector.cpp:255:13:255:14 | call to iterator [post update] | vector.cpp:277:1:277:1 | v3 | |
| vector.cpp:255:13:255:14 | i1 | vector.cpp:255:13:255:14 | call to iterator | |
| vector.cpp:255:13:255:14 | i1 [post update] | vector.cpp:277:1:277:1 | v3 | |
| vector.cpp:255:17:255:18 | call to iterator | vector.cpp:255:3:255:4 | ref arg v6 | TAINT |
| vector.cpp:255:17:255:18 | i2 | vector.cpp:255:17:255:18 | call to iterator | |
| vector.cpp:257:8:257:9 | ref arg v4 | vector.cpp:262:2:262:2 | v4 | |
| vector.cpp:258:8:258:9 | ref arg v5 | vector.cpp:262:2:262:2 | v5 | |
@@ -7476,13 +7384,10 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:267:28:267:29 | call to vector | vector.cpp:276:2:276:2 | v9 | |
| vector.cpp:269:3:269:4 | ref arg v7 | vector.cpp:273:8:273:9 | v7 | |
| vector.cpp:269:3:269:4 | ref arg v7 | vector.cpp:276:2:276:2 | v7 | |
| vector.cpp:269:18:269:31 | call to source | vector.cpp:269:3:269:4 | ref arg v7 | TAINT |
| vector.cpp:270:3:270:4 | ref arg v8 | vector.cpp:274:8:274:9 | v8 | |
| vector.cpp:270:3:270:4 | ref arg v8 | vector.cpp:276:2:276:2 | v8 | |
| vector.cpp:270:18:270:35 | call to source | vector.cpp:270:3:270:4 | ref arg v8 | TAINT |
| vector.cpp:271:3:271:4 | ref arg v9 | vector.cpp:275:8:275:9 | v9 | |
| vector.cpp:271:3:271:4 | ref arg v9 | vector.cpp:276:2:276:2 | v9 | |
| vector.cpp:271:18:271:34 | call to source | vector.cpp:271:3:271:4 | ref arg v9 | TAINT |
| vector.cpp:273:8:273:9 | ref arg v7 | vector.cpp:276:2:276:2 | v7 | |
| vector.cpp:274:8:274:9 | ref arg v8 | vector.cpp:276:2:276:2 | v8 | |
| vector.cpp:275:8:275:9 | ref arg v9 | vector.cpp:276:2:276:2 | v9 | |
@@ -7500,16 +7405,12 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:284:2:284:3 | ref arg v1 | vector.cpp:286:7:286:8 | v1 | |
| vector.cpp:284:2:284:3 | ref arg v1 | vector.cpp:287:7:287:8 | v1 | |
| vector.cpp:284:2:284:3 | ref arg v1 | vector.cpp:293:1:293:1 | v1 | |
| vector.cpp:284:15:284:20 | call to source | vector.cpp:284:2:284:3 | ref arg v1 | TAINT |
| vector.cpp:285:7:285:8 | ref arg v1 | vector.cpp:286:7:286:8 | v1 | |
| vector.cpp:285:7:285:8 | ref arg v1 | vector.cpp:287:7:287:8 | v1 | |
| vector.cpp:285:7:285:8 | ref arg v1 | vector.cpp:293:1:293:1 | v1 | |
| vector.cpp:286:7:286:8 | ref arg v1 | vector.cpp:287:7:287:8 | v1 | |
| vector.cpp:286:7:286:8 | ref arg v1 | vector.cpp:293:1:293:1 | v1 | |
| vector.cpp:286:7:286:8 | v1 | vector.cpp:286:10:286:13 | call to data | TAINT |
| vector.cpp:286:10:286:13 | ref arg call to data | vector.cpp:286:7:286:8 | ref arg v1 | TAINT |
| vector.cpp:287:7:287:8 | ref arg v1 | vector.cpp:293:1:293:1 | v1 | |
| vector.cpp:287:7:287:8 | v1 | vector.cpp:287:10:287:13 | call to data | TAINT |
| vector.cpp:287:10:287:13 | call to data | vector.cpp:287:7:287:18 | access to array | TAINT |
| vector.cpp:287:17:287:17 | 2 | vector.cpp:287:7:287:18 | access to array | TAINT |
| vector.cpp:289:2:289:13 | * ... [post update] | vector.cpp:289:7:289:10 | call to data [inner post update] | |
@@ -7518,19 +7419,14 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:289:4:289:5 | ref arg v2 | vector.cpp:291:7:291:8 | v2 | |
| vector.cpp:289:4:289:5 | ref arg v2 | vector.cpp:292:7:292:8 | v2 | |
| vector.cpp:289:4:289:5 | ref arg v2 | vector.cpp:293:1:293:1 | v2 | |
| vector.cpp:289:4:289:5 | v2 | vector.cpp:289:7:289:10 | call to data | TAINT |
| vector.cpp:289:7:289:10 | call to data | vector.cpp:289:2:289:13 | * ... | TAINT |
| vector.cpp:289:7:289:10 | call to data [inner post update] | vector.cpp:289:4:289:5 | ref arg v2 | TAINT |
| vector.cpp:289:17:289:30 | call to source | vector.cpp:289:2:289:32 | ... = ... | |
| vector.cpp:290:7:290:8 | ref arg v2 | vector.cpp:291:7:291:8 | v2 | |
| vector.cpp:290:7:290:8 | ref arg v2 | vector.cpp:292:7:292:8 | v2 | |
| vector.cpp:290:7:290:8 | ref arg v2 | vector.cpp:293:1:293:1 | v2 | |
| vector.cpp:291:7:291:8 | ref arg v2 | vector.cpp:292:7:292:8 | v2 | |
| vector.cpp:291:7:291:8 | ref arg v2 | vector.cpp:293:1:293:1 | v2 | |
| vector.cpp:291:7:291:8 | v2 | vector.cpp:291:10:291:13 | call to data | TAINT |
| vector.cpp:291:10:291:13 | ref arg call to data | vector.cpp:291:7:291:8 | ref arg v2 | TAINT |
| vector.cpp:292:7:292:8 | ref arg v2 | vector.cpp:293:1:293:1 | v2 | |
| vector.cpp:292:7:292:8 | v2 | vector.cpp:292:10:292:13 | call to data | TAINT |
| vector.cpp:292:10:292:13 | call to data | vector.cpp:292:7:292:18 | access to array | TAINT |
| vector.cpp:292:17:292:17 | 2 | vector.cpp:292:7:292:18 | access to array | TAINT |
| vector.cpp:298:19:298:19 | call to vector | vector.cpp:305:7:305:7 | a | |
@@ -7559,8 +7455,6 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:303:2:303:2 | ref arg d | vector.cpp:311:16:311:16 | d | |
| vector.cpp:303:2:303:2 | ref arg d | vector.cpp:312:7:312:7 | d | |
| vector.cpp:303:2:303:2 | ref arg d | vector.cpp:313:1:313:1 | d | |
| vector.cpp:303:14:303:19 | call to source | vector.cpp:303:2:303:2 | ref arg d | TAINT |
| vector.cpp:305:7:305:7 | a | vector.cpp:305:9:305:14 | call to insert | TAINT |
| vector.cpp:305:7:305:7 | ref arg a | vector.cpp:306:7:306:7 | a | |
| vector.cpp:305:7:305:7 | ref arg a | vector.cpp:311:25:311:25 | a | |
| vector.cpp:305:7:305:7 | ref arg a | vector.cpp:311:36:311:36 | a | |
@@ -7575,16 +7469,11 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:305:25:305:25 | b | vector.cpp:305:27:305:31 | call to begin | TAINT |
| vector.cpp:305:25:305:25 | ref arg b | vector.cpp:305:36:305:36 | b | |
| vector.cpp:305:25:305:25 | ref arg b | vector.cpp:313:1:313:1 | b | |
| vector.cpp:305:27:305:31 | call to begin | vector.cpp:305:7:305:7 | ref arg a | TAINT |
| vector.cpp:305:27:305:31 | call to begin | vector.cpp:305:9:305:14 | call to insert | TAINT |
| vector.cpp:305:36:305:36 | b | vector.cpp:305:38:305:40 | call to end | TAINT |
| vector.cpp:305:36:305:36 | ref arg b | vector.cpp:313:1:313:1 | b | |
| vector.cpp:305:38:305:40 | call to end | vector.cpp:305:7:305:7 | ref arg a | TAINT |
| vector.cpp:305:38:305:40 | call to end | vector.cpp:305:9:305:14 | call to insert | TAINT |
| vector.cpp:306:7:306:7 | ref arg a | vector.cpp:311:25:311:25 | a | |
| vector.cpp:306:7:306:7 | ref arg a | vector.cpp:311:36:311:36 | a | |
| vector.cpp:306:7:306:7 | ref arg a | vector.cpp:313:1:313:1 | a | |
| vector.cpp:308:7:308:7 | c | vector.cpp:308:9:308:14 | call to insert | TAINT |
| vector.cpp:308:7:308:7 | ref arg c | vector.cpp:309:7:309:7 | c | |
| vector.cpp:308:7:308:7 | ref arg c | vector.cpp:313:1:313:1 | c | |
| vector.cpp:308:16:308:16 | c | vector.cpp:308:18:308:20 | call to end | TAINT |
@@ -7598,17 +7487,12 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:308:25:308:25 | ref arg d | vector.cpp:311:16:311:16 | d | |
| vector.cpp:308:25:308:25 | ref arg d | vector.cpp:312:7:312:7 | d | |
| vector.cpp:308:25:308:25 | ref arg d | vector.cpp:313:1:313:1 | d | |
| vector.cpp:308:27:308:31 | call to begin | vector.cpp:308:7:308:7 | ref arg c | TAINT |
| vector.cpp:308:27:308:31 | call to begin | vector.cpp:308:9:308:14 | call to insert | TAINT |
| vector.cpp:308:36:308:36 | d | vector.cpp:308:38:308:40 | call to end | TAINT |
| vector.cpp:308:36:308:36 | ref arg d | vector.cpp:311:7:311:7 | d | |
| vector.cpp:308:36:308:36 | ref arg d | vector.cpp:311:16:311:16 | d | |
| vector.cpp:308:36:308:36 | ref arg d | vector.cpp:312:7:312:7 | d | |
| vector.cpp:308:36:308:36 | ref arg d | vector.cpp:313:1:313:1 | d | |
| vector.cpp:308:38:308:40 | call to end | vector.cpp:308:7:308:7 | ref arg c | TAINT |
| vector.cpp:308:38:308:40 | call to end | vector.cpp:308:9:308:14 | call to insert | TAINT |
| vector.cpp:309:7:309:7 | ref arg c | vector.cpp:313:1:313:1 | c | |
| vector.cpp:311:7:311:7 | d | vector.cpp:311:9:311:14 | call to insert | TAINT |
| vector.cpp:311:7:311:7 | ref arg d | vector.cpp:312:7:312:7 | d | |
| vector.cpp:311:7:311:7 | ref arg d | vector.cpp:313:1:313:1 | d | |
| vector.cpp:311:16:311:16 | d | vector.cpp:311:18:311:20 | call to end | TAINT |
@@ -7619,12 +7503,8 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:311:25:311:25 | a | vector.cpp:311:27:311:31 | call to begin | TAINT |
| vector.cpp:311:25:311:25 | ref arg a | vector.cpp:311:36:311:36 | a | |
| vector.cpp:311:25:311:25 | ref arg a | vector.cpp:313:1:313:1 | a | |
| vector.cpp:311:27:311:31 | call to begin | vector.cpp:311:7:311:7 | ref arg d | TAINT |
| vector.cpp:311:27:311:31 | call to begin | vector.cpp:311:9:311:14 | call to insert | TAINT |
| vector.cpp:311:36:311:36 | a | vector.cpp:311:38:311:40 | call to end | TAINT |
| vector.cpp:311:36:311:36 | ref arg a | vector.cpp:313:1:313:1 | a | |
| vector.cpp:311:38:311:40 | call to end | vector.cpp:311:7:311:7 | ref arg d | TAINT |
| vector.cpp:311:38:311:40 | call to end | vector.cpp:311:9:311:14 | call to insert | TAINT |
| vector.cpp:312:7:312:7 | ref arg d | vector.cpp:313:1:313:1 | d | |
| vector.cpp:316:19:316:20 | call to vector | vector.cpp:320:22:320:23 | v1 | |
| vector.cpp:316:19:316:20 | call to vector | vector.cpp:320:34:320:35 | v1 | |
@@ -7639,29 +7519,24 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:318:2:318:3 | ref arg v2 | vector.cpp:321:34:321:35 | v2 | |
| vector.cpp:318:2:318:3 | ref arg v2 | vector.cpp:324:7:324:8 | v2 | |
| vector.cpp:318:2:318:3 | ref arg v2 | vector.cpp:327:1:327:1 | v2 | |
| vector.cpp:318:15:318:20 | call to source | vector.cpp:318:2:318:3 | ref arg v2 | TAINT |
| vector.cpp:320:22:320:23 | ref arg v1 | vector.cpp:320:34:320:35 | v1 | |
| vector.cpp:320:22:320:23 | ref arg v1 | vector.cpp:323:7:323:8 | v1 | |
| vector.cpp:320:22:320:23 | ref arg v1 | vector.cpp:327:1:327:1 | v1 | |
| vector.cpp:320:22:320:23 | v1 | vector.cpp:320:25:320:29 | call to begin | TAINT |
| vector.cpp:320:22:320:42 | call to vector | vector.cpp:325:7:325:8 | v3 | |
| vector.cpp:320:22:320:42 | call to vector | vector.cpp:327:1:327:1 | v3 | |
| vector.cpp:320:25:320:29 | call to begin | vector.cpp:320:22:320:42 | call to vector | TAINT |
| vector.cpp:320:34:320:35 | ref arg v1 | vector.cpp:323:7:323:8 | v1 | |
| vector.cpp:320:34:320:35 | ref arg v1 | vector.cpp:327:1:327:1 | v1 | |
| vector.cpp:320:34:320:35 | v1 | vector.cpp:320:37:320:39 | call to end | TAINT |
| vector.cpp:320:37:320:39 | call to end | vector.cpp:320:22:320:42 | call to vector | TAINT |
| vector.cpp:321:22:321:23 | ref arg v2 | vector.cpp:321:34:321:35 | v2 | |
| vector.cpp:321:22:321:23 | ref arg v2 | vector.cpp:324:7:324:8 | v2 | |
| vector.cpp:321:22:321:23 | ref arg v2 | vector.cpp:327:1:327:1 | v2 | |
| vector.cpp:321:22:321:23 | v2 | vector.cpp:321:25:321:29 | call to begin | TAINT |
| vector.cpp:321:22:321:42 | call to vector | vector.cpp:326:7:326:8 | v4 | |
| vector.cpp:321:22:321:42 | call to vector | vector.cpp:327:1:327:1 | v4 | |
| vector.cpp:321:25:321:29 | call to begin | vector.cpp:321:22:321:42 | call to vector | TAINT |
| vector.cpp:321:34:321:35 | ref arg v2 | vector.cpp:324:7:324:8 | v2 | |
| vector.cpp:321:34:321:35 | ref arg v2 | vector.cpp:327:1:327:1 | v2 | |
| vector.cpp:321:34:321:35 | v2 | vector.cpp:321:37:321:39 | call to end | TAINT |
| vector.cpp:321:37:321:39 | call to end | vector.cpp:321:22:321:42 | call to vector | TAINT |
| vector.cpp:323:7:323:8 | ref arg v1 | vector.cpp:327:1:327:1 | v1 | |
| vector.cpp:324:7:324:8 | ref arg v2 | vector.cpp:327:1:327:1 | v2 | |
| vector.cpp:325:7:325:8 | ref arg v3 | vector.cpp:327:1:327:1 | v3 | |
@@ -8099,9 +7974,7 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:472:10:472:14 | ref arg & ... | vector.cpp:472:12:472:12 | call to operator[] [inner post update] | |
| vector.cpp:472:11:472:11 | ref arg v | vector.cpp:473:8:473:8 | v | |
| vector.cpp:472:11:472:11 | ref arg v | vector.cpp:474:2:474:2 | v | |
| vector.cpp:472:11:472:11 | v | vector.cpp:472:12:472:12 | call to operator[] | TAINT |
| vector.cpp:472:12:472:12 | call to operator[] | vector.cpp:472:10:472:14 | & ... | |
| vector.cpp:472:12:472:12 | call to operator[] [inner post update] | vector.cpp:472:11:472:11 | ref arg v | TAINT |
| vector.cpp:472:17:472:18 | & ... | vector.cpp:472:3:472:8 | call to memcpy | TAINT |
| vector.cpp:472:17:472:18 | & ... | vector.cpp:472:10:472:14 | ref arg & ... | TAINT |
| vector.cpp:472:18:472:18 | s | vector.cpp:472:10:472:14 | ref arg & ... | |
@@ -8124,11 +7997,9 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:483:8:483:9 | ref arg cs | vector.cpp:487:2:487:2 | cs | |
| vector.cpp:484:10:484:22 | & ... | vector.cpp:484:3:484:8 | call to memcpy | |
| vector.cpp:484:10:484:22 | ref arg & ... | vector.cpp:484:13:484:13 | call to operator[] [inner post update] | |
| vector.cpp:484:11:484:12 | cs | vector.cpp:484:13:484:13 | call to operator[] | TAINT |
| vector.cpp:484:11:484:12 | ref arg cs | vector.cpp:486:8:486:9 | cs | |
| vector.cpp:484:11:484:12 | ref arg cs | vector.cpp:487:2:487:2 | cs | |
| vector.cpp:484:13:484:13 | call to operator[] | vector.cpp:484:10:484:22 | & ... | |
| vector.cpp:484:13:484:13 | call to operator[] [inner post update] | vector.cpp:484:11:484:12 | ref arg cs | TAINT |
| vector.cpp:484:14:484:17 | offs | vector.cpp:484:14:484:21 | ... + ... | TAINT |
| vector.cpp:484:21:484:21 | 1 | vector.cpp:484:14:484:21 | ... + ... | TAINT |
| vector.cpp:484:25:484:27 | src | vector.cpp:484:29:484:33 | call to c_str | TAINT |
@@ -8144,7 +8015,6 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:491:30:491:32 | call to vector | vector.cpp:498:1:498:1 | v2 | |
| vector.cpp:493:2:493:3 | ref arg v1 | vector.cpp:494:7:494:8 | v1 | |
| vector.cpp:493:2:493:3 | ref arg v1 | vector.cpp:498:1:498:1 | v1 | |
| vector.cpp:493:18:493:23 | call to source | vector.cpp:493:2:493:3 | ref arg v1 | TAINT |
| vector.cpp:494:7:494:8 | ref arg v1 | vector.cpp:498:1:498:1 | v1 | |
| vector.cpp:496:2:496:3 | ref arg v2 | vector.cpp:497:7:497:8 | v2 | |
| vector.cpp:496:2:496:3 | ref arg v2 | vector.cpp:498:1:498:1 | v2 | |
@@ -8153,8 +8023,6 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:496:13:496:14 | ref arg v2 | vector.cpp:498:1:498:1 | v2 | |
| vector.cpp:496:13:496:14 | v2 | vector.cpp:496:16:496:20 | call to begin | TAINT |
| vector.cpp:496:16:496:20 | call to begin | vector.cpp:496:13:496:22 | call to iterator | TAINT |
| vector.cpp:496:25:496:30 | call to source | vector.cpp:496:2:496:3 | ref arg v2 | TAINT |
| vector.cpp:496:25:496:30 | call to source | vector.cpp:496:5:496:11 | call to emplace | TAINT |
| vector.cpp:497:7:497:8 | ref arg v2 | vector.cpp:498:1:498:1 | v2 | |
| vector.cpp:503:18:503:21 | {...} | vector.cpp:506:8:506:9 | as | |
| vector.cpp:503:18:503:21 | {...} | vector.cpp:507:8:507:9 | as | |
@@ -8185,16 +8053,13 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:526:8:526:9 | vs | |
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:532:8:532:9 | vs | |
| vector.cpp:520:25:520:31 | call to vector | vector.cpp:533:2:533:2 | vs | |
| vector.cpp:520:30:520:30 | 0 | vector.cpp:520:25:520:31 | call to vector | TAINT |
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:524:8:524:9 | vs | |
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:526:8:526:9 | vs | |
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
| vector.cpp:523:8:523:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
| vector.cpp:523:8:523:9 | vs | vector.cpp:523:10:523:10 | call to operator[] | TAINT |
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:526:8:526:9 | vs | |
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
| vector.cpp:524:8:524:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
| vector.cpp:524:8:524:9 | vs | vector.cpp:524:10:524:10 | call to operator[] | TAINT |
| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:532:8:532:9 | vs | |
| vector.cpp:526:8:526:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
| vector.cpp:526:8:526:9 | vs | vector.cpp:526:11:526:15 | call to begin | TAINT |
@@ -8222,7 +8087,6 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
| vector.cpp:530:9:530:14 | call to source | vector.cpp:530:3:530:4 | ref arg it | TAINT |
| vector.cpp:531:9:531:10 | it | vector.cpp:531:8:531:8 | call to operator* | TAINT |
| vector.cpp:532:8:532:9 | ref arg vs | vector.cpp:533:2:533:2 | vs | |
| vector.cpp:532:8:532:9 | vs | vector.cpp:532:10:532:10 | call to operator[] | TAINT |
| zmq.cpp:17:21:17:26 | socket | zmq.cpp:17:21:17:26 | socket | |
| zmq.cpp:17:35:17:46 | message_data | zmq.cpp:17:35:17:46 | message_data | |
| zmq.cpp:17:35:17:46 | message_data | zmq.cpp:20:35:20:46 | message_data | |

597
cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected Normal file
View File

@@ -0,0 +1,597 @@
signatureMatches
| stl.h:182:17:182:22 | assign | (InputIt,InputIt) | deque | assign<InputIt> | 0 |
| stl.h:182:17:182:22 | assign | (InputIt,InputIt) | deque | assign<InputIt> | 1 |
| stl.h:182:17:182:22 | assign | (InputIt,InputIt) | forward_list | assign<InputIt> | 0 |
| stl.h:182:17:182:22 | assign | (InputIt,InputIt) | forward_list | assign<InputIt> | 1 |
| stl.h:182:17:182:22 | assign | (InputIt,InputIt) | list | assign<InputIt> | 0 |
| stl.h:182:17:182:22 | assign | (InputIt,InputIt) | list | assign<InputIt> | 1 |
| stl.h:182:17:182:22 | assign | (InputIt,InputIt) | vector | assign<InputIt> | 0 |
| stl.h:182:17:182:22 | assign | (InputIt,InputIt) | vector | assign<InputIt> | 1 |
| stl.h:185:17:185:22 | insert | (InputIt,InputIt) | deque | assign<InputIt> | 0 |
| stl.h:185:17:185:22 | insert | (InputIt,InputIt) | deque | assign<InputIt> | 1 |
| stl.h:185:17:185:22 | insert | (InputIt,InputIt) | forward_list | assign<InputIt> | 0 |
| stl.h:185:17:185:22 | insert | (InputIt,InputIt) | forward_list | assign<InputIt> | 1 |
| stl.h:185:17:185:22 | insert | (InputIt,InputIt) | list | assign<InputIt> | 0 |
| stl.h:185:17:185:22 | insert | (InputIt,InputIt) | list | assign<InputIt> | 1 |
| stl.h:185:17:185:22 | insert | (InputIt,InputIt) | vector | assign<InputIt> | 0 |
| stl.h:185:17:185:22 | insert | (InputIt,InputIt) | vector | assign<InputIt> | 1 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 0 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 1 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 2 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 0 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 1 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 2 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 0 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 1 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 2 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 0 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 1 |
| stl.h:190:17:190:23 | replace | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 2 |
| stl.h:294:12:294:17 | vector | (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:294:12:294:17 | vector | (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:294:12:294:17 | vector | (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:294:12:294:17 | vector | (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:294:12:294:17 | vector | (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:294:12:294:17 | vector | (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:294:12:294:17 | vector | (const list &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:294:12:294:17 | vector | (const list &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:294:12:294:17 | vector | (const list &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:294:12:294:17 | vector | (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:294:12:294:17 | vector | (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:294:12:294:17 | vector | (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:294:12:294:17 | vector | (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:294:12:294:17 | vector | (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:294:12:294:17 | vector | (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:294:12:294:17 | vector | (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:294:12:294:17 | vector | (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:294:12:294:17 | vector | (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:294:12:294:17 | vector | (list &&,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:294:12:294:17 | vector | (list &&,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:294:12:294:17 | vector | (list &&,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:294:12:294:17 | vector | (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:294:12:294:17 | vector | (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:294:12:294:17 | vector | (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:295:3:295:8 | vector | (InputIterator,InputIterator,const Allocator &) | deque<T,Allocator> | deque<InputIterator> | 2 |
| stl.h:295:3:295:8 | vector | (InputIterator,InputIterator,const Allocator &) | deque<T,Allocator> | deque<InputIterator> | 2 |
| stl.h:295:3:295:8 | vector | (InputIterator,InputIterator,const Allocator &) | forward_list<T,Allocator> | forward_list | 2 |
| stl.h:295:3:295:8 | vector | (InputIterator,InputIterator,const Allocator &) | forward_list<T,Allocator> | forward_list | 2 |
| stl.h:295:3:295:8 | vector | (InputIterator,InputIterator,const Allocator &) | list<T,Allocator> | list<InputIterator> | 2 |
| stl.h:295:3:295:8 | vector | (InputIterator,InputIterator,const Allocator &) | list<T,Allocator> | list<InputIterator> | 2 |
| stl.h:295:3:295:8 | vector | (InputIterator,InputIterator,const Allocator &) | vector<T,Allocator> | vector<InputIterator> | 2 |
| stl.h:295:3:295:8 | vector | (InputIterator,InputIterator,const Allocator &) | vector<T,Allocator> | vector<InputIterator> | 2 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 0 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 0 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 2 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 2 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 0 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 0 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 2 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 2 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 0 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 0 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 2 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 2 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 0 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 0 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 2 |
| stl.h:295:3:295:8 | vector | (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 2 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | deque<T,Allocator> | deque<InputIterator> | 0 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | deque<T,Allocator> | deque<InputIterator> | 1 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | deque<T,Allocator> | deque<InputIterator> | 2 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | forward_list<T,Allocator> | forward_list | 2 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | list<T,Allocator> | list<InputIterator> | 0 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | list<T,Allocator> | list<InputIterator> | 1 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | list<T,Allocator> | list<InputIterator> | 2 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | vector<T,Allocator> | vector<InputIterator> | 0 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | vector<T,Allocator> | vector<InputIterator> | 1 |
| stl.h:296:101:296:106 | vector | (InputIterator,InputIterator,const Allocator &) | vector<T,Allocator> | vector<InputIterator> | 2 |
| stl.h:296:101:296:106 | vector | (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 2 |
| stl.h:296:101:296:106 | vector | (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 2 |
| stl.h:296:101:296:106 | vector | (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 2 |
| stl.h:296:101:296:106 | vector | (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 2 |
| stl.h:301:11:301:19 | operator= | (const vector &) | vector | vector | 0 |
| stl.h:302:11:302:19 | operator= | (vector &&) | vector | vector | 0 |
| stl.h:303:106:303:111 | assign | (InputIt,InputIt) | deque | assign<InputIt> | 0 |
| stl.h:303:106:303:111 | assign | (InputIt,InputIt) | deque | assign<InputIt> | 1 |
| stl.h:303:106:303:111 | assign | (InputIt,InputIt) | forward_list | assign<InputIt> | 0 |
| stl.h:303:106:303:111 | assign | (InputIt,InputIt) | forward_list | assign<InputIt> | 1 |
| stl.h:303:106:303:111 | assign | (InputIt,InputIt) | list | assign<InputIt> | 0 |
| stl.h:303:106:303:111 | assign | (InputIt,InputIt) | list | assign<InputIt> | 1 |
| stl.h:303:106:303:111 | assign | (InputIt,InputIt) | vector | assign<InputIt> | 0 |
| stl.h:303:106:303:111 | assign | (InputIt,InputIt) | vector | assign<InputIt> | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | deque<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | deque<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | deque<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | forward_list<T> | insert_after | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | forward_list<T> | insert_after | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | forward_list<T> | insert_after | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | list<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | list<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | list<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | vector<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | vector<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (const_iterator,const T &) | vector<T> | insert | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | deque<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | deque<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | deque<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | deque<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | deque<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | deque<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | forward_list<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | forward_list<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | forward_list<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | forward_list<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | forward_list<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | forward_list<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | list<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | list<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | list<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | list<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | list<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | list<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | vector<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | vector<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | vector<T,Allocator> | assign | 0 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | vector<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | vector<T,Allocator> | assign | 1 |
| stl.h:306:8:306:13 | assign | (size_type,const T &) | vector<T,Allocator> | assign | 1 |
| stl.h:331:12:331:17 | insert | (const_iterator,T &&) | deque<T> | insert | 0 |
| stl.h:331:12:331:17 | insert | (const_iterator,T &&) | deque<T> | insert | 1 |
| stl.h:331:12:331:17 | insert | (const_iterator,T &&) | forward_list<T> | insert_after | 0 |
| stl.h:331:12:331:17 | insert | (const_iterator,T &&) | forward_list<T> | insert_after | 1 |
| stl.h:331:12:331:17 | insert | (const_iterator,T &&) | list<T> | insert | 0 |
| stl.h:331:12:331:17 | insert | (const_iterator,T &&) | list<T> | insert | 1 |
| stl.h:331:12:331:17 | insert | (const_iterator,T &&) | vector<T> | insert | 0 |
| stl.h:331:12:331:17 | insert | (const_iterator,T &&) | vector<T> | insert | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 0 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 0 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 2 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 2 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 0 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 0 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 2 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 2 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 0 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 0 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 2 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 2 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 0 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 0 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 1 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 2 |
| stl.h:333:42:333:47 | insert | (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 2 |
| stl.h:396:3:396:3 | pair | (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (const list &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (const list &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (const list &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (const list &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (const list &,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 |
| stl.h:396:3:396:3 | pair | (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 |
| stl.h:396:3:396:3 | pair | (list &&,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (list &&,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (list &&,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (list &&,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (list &&,const Allocator &) | list<T,Allocator> | list | 1 |
| stl.h:396:3:396:3 | pair | (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:396:3:396:3 | pair | (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 |
| stl.h:557:33:557:35 | set | (InputIt,InputIt) | deque | assign<InputIt> | 0 |
| stl.h:557:33:557:35 | set | (InputIt,InputIt) | deque | assign<InputIt> | 1 |
| stl.h:557:33:557:35 | set | (InputIt,InputIt) | forward_list | assign<InputIt> | 0 |
| stl.h:557:33:557:35 | set | (InputIt,InputIt) | forward_list | assign<InputIt> | 1 |
| stl.h:557:33:557:35 | set | (InputIt,InputIt) | list | assign<InputIt> | 0 |
| stl.h:557:33:557:35 | set | (InputIt,InputIt) | list | assign<InputIt> | 1 |
| stl.h:557:33:557:35 | set | (InputIt,InputIt) | vector | assign<InputIt> | 0 |
| stl.h:557:33:557:35 | set | (InputIt,InputIt) | vector | assign<InputIt> | 1 |
| stl.h:574:38:574:43 | insert | (InputIt,InputIt) | deque | assign<InputIt> | 0 |
| stl.h:574:38:574:43 | insert | (InputIt,InputIt) | deque | assign<InputIt> | 1 |
| stl.h:574:38:574:43 | insert | (InputIt,InputIt) | forward_list | assign<InputIt> | 0 |
| stl.h:574:38:574:43 | insert | (InputIt,InputIt) | forward_list | assign<InputIt> | 1 |
| stl.h:574:38:574:43 | insert | (InputIt,InputIt) | list | assign<InputIt> | 0 |
| stl.h:574:38:574:43 | insert | (InputIt,InputIt) | list | assign<InputIt> | 1 |
| stl.h:574:38:574:43 | insert | (InputIt,InputIt) | vector | assign<InputIt> | 0 |
| stl.h:574:38:574:43 | insert | (InputIt,InputIt) | vector | assign<InputIt> | 1 |
| stl.h:628:38:628:43 | insert | (InputIt,InputIt) | deque | assign<InputIt> | 0 |
| stl.h:628:38:628:43 | insert | (InputIt,InputIt) | deque | assign<InputIt> | 1 |
| stl.h:628:38:628:43 | insert | (InputIt,InputIt) | forward_list | assign<InputIt> | 0 |
| stl.h:628:38:628:43 | insert | (InputIt,InputIt) | forward_list | assign<InputIt> | 1 |
| stl.h:628:38:628:43 | insert | (InputIt,InputIt) | list | assign<InputIt> | 0 |
| stl.h:628:38:628:43 | insert | (InputIt,InputIt) | list | assign<InputIt> | 1 |
| stl.h:628:38:628:43 | insert | (InputIt,InputIt) | vector | assign<InputIt> | 0 |
| stl.h:628:38:628:43 | insert | (InputIt,InputIt) | vector | assign<InputIt> | 1 |
getSignatureParameterName
| (InputIt,InputIt) | deque | assign<InputIt> | 0 | func:0 |
| (InputIt,InputIt) | deque | assign<InputIt> | 1 | func:0 |
| (InputIt,InputIt) | forward_list | assign<InputIt> | 0 | func:0 |
| (InputIt,InputIt) | forward_list | assign<InputIt> | 1 | func:0 |
| (InputIt,InputIt) | list | assign<InputIt> | 0 | func:0 |
| (InputIt,InputIt) | list | assign<InputIt> | 1 | func:0 |
| (InputIt,InputIt) | vector | assign<InputIt> | 0 | func:0 |
| (InputIt,InputIt) | vector | assign<InputIt> | 1 | func:0 |
| (InputIterator,InputIterator,const Allocator &) | deque<T,Allocator> | deque<InputIterator> | 0 | func:0 |
| (InputIterator,InputIterator,const Allocator &) | deque<T,Allocator> | deque<InputIterator> | 1 | func:0 |
| (InputIterator,InputIterator,const Allocator &) | deque<T,Allocator> | deque<InputIterator> | 2 | const class:1 & |
| (InputIterator,InputIterator,const Allocator &) | forward_list<T,Allocator> | forward_list | 0 | InputIterator |
| (InputIterator,InputIterator,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 | InputIterator |
| (InputIterator,InputIterator,const Allocator &) | forward_list<T,Allocator> | forward_list | 2 | const class:1 & |
| (InputIterator,InputIterator,const Allocator &) | list<T,Allocator> | list<InputIterator> | 0 | func:0 |
| (InputIterator,InputIterator,const Allocator &) | list<T,Allocator> | list<InputIterator> | 1 | func:0 |
| (InputIterator,InputIterator,const Allocator &) | list<T,Allocator> | list<InputIterator> | 2 | const class:1 & |
| (InputIterator,InputIterator,const Allocator &) | vector<T,Allocator> | vector<InputIterator> | 0 | func:0 |
| (InputIterator,InputIterator,const Allocator &) | vector<T,Allocator> | vector<InputIterator> | 1 | func:0 |
| (InputIterator,InputIterator,const Allocator &) | vector<T,Allocator> | vector<InputIterator> | 2 | const class:1 & |
| (const deque &) | deque | deque | 0 | const deque & |
| (const deque &,const Allocator &) | deque<T,Allocator> | deque | 0 | const deque & |
| (const deque &,const Allocator &) | deque<T,Allocator> | deque | 1 | const class:1 & |
| (const forward_list &) | forward_list | forward_list | 0 | const forward_list & |
| (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 0 | const forward_list & |
| (const forward_list &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 | const class:1 & |
| (const list &) | list | list | 0 | const list & |
| (const list &,const Allocator &) | list<T,Allocator> | list | 0 | const list & |
| (const list &,const Allocator &) | list<T,Allocator> | list | 1 | const class:1 & |
| (const vector &) | vector | vector | 0 | const vector & |
| (const vector &,const Allocator &) | vector<T,Allocator> | vector | 0 | const vector & |
| (const vector &,const Allocator &) | vector<T,Allocator> | vector | 1 | const class:1 & |
| (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 0 | const_iterator |
| (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 1 | func:0 |
| (const_iterator,InputIt,InputIt) | deque | insert<InputIt> | 2 | func:0 |
| (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 0 | const_iterator |
| (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 1 | func:0 |
| (const_iterator,InputIt,InputIt) | forward_list | insert_after<InputIt> | 2 | func:0 |
| (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 0 | const_iterator |
| (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 1 | func:0 |
| (const_iterator,InputIt,InputIt) | list | insert<InputIt> | 2 | func:0 |
| (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 0 | const_iterator |
| (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 1 | func:0 |
| (const_iterator,InputIt,InputIt) | vector | insert<InputIt> | 2 | func:0 |
| (const_iterator,T &&) | deque<T> | insert | 0 | const_iterator |
| (const_iterator,T &&) | deque<T> | insert | 1 | class:0 && |
| (const_iterator,T &&) | forward_list<T> | insert_after | 0 | const_iterator |
| (const_iterator,T &&) | forward_list<T> | insert_after | 1 | class:0 && |
| (const_iterator,T &&) | list<T> | insert | 0 | const_iterator |
| (const_iterator,T &&) | list<T> | insert | 1 | class:0 && |
| (const_iterator,T &&) | vector<T> | insert | 0 | const_iterator |
| (const_iterator,T &&) | vector<T> | insert | 1 | class:0 && |
| (const_iterator,const T &) | deque<T> | insert | 0 | const_iterator |
| (const_iterator,const T &) | deque<T> | insert | 1 | const class:0 & |
| (const_iterator,const T &) | forward_list<T> | insert_after | 0 | const_iterator |
| (const_iterator,const T &) | forward_list<T> | insert_after | 1 | const class:0 & |
| (const_iterator,const T &) | list<T> | insert | 0 | const_iterator |
| (const_iterator,const T &) | list<T> | insert | 1 | const class:0 & |
| (const_iterator,const T &) | vector<T> | insert | 0 | const_iterator |
| (const_iterator,const T &) | vector<T> | insert | 1 | const class:0 & |
| (const_iterator,size_type,const T &) | deque<T> | insert | 0 | const_iterator |
| (const_iterator,size_type,const T &) | deque<T> | insert | 1 | size_type |
| (const_iterator,size_type,const T &) | deque<T> | insert | 2 | const class:0 & |
| (const_iterator,size_type,const T &) | forward_list<T> | insert_after | 0 | const_iterator |
| (const_iterator,size_type,const T &) | forward_list<T> | insert_after | 1 | size_type |
| (const_iterator,size_type,const T &) | forward_list<T> | insert_after | 2 | const class:0 & |
| (const_iterator,size_type,const T &) | list<T> | insert | 0 | const_iterator |
| (const_iterator,size_type,const T &) | list<T> | insert | 1 | size_type |
| (const_iterator,size_type,const T &) | list<T> | insert | 2 | const class:0 & |
| (const_iterator,size_type,const T &) | vector<T> | insert | 0 | const_iterator |
| (const_iterator,size_type,const T &) | vector<T> | insert | 1 | size_type |
| (const_iterator,size_type,const T &) | vector<T> | insert | 2 | const class:0 & |
| (deque &&) | deque | deque | 0 | deque && |
| (deque &&,const Allocator &) | deque<T,Allocator> | deque | 0 | deque && |
| (deque &&,const Allocator &) | deque<T,Allocator> | deque | 1 | const class:1 & |
| (forward_list &&) | forward_list | forward_list | 0 | forward_list && |
| (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 0 | forward_list && |
| (forward_list &&,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 | const class:1 & |
| (list &&) | list | list | 0 | list && |
| (list &&,const Allocator &) | list<T,Allocator> | list | 0 | list && |
| (list &&,const Allocator &) | list<T,Allocator> | list | 1 | const class:1 & |
| (size_type,const T &) | deque<T,Allocator> | assign | 0 | size_type |
| (size_type,const T &) | deque<T,Allocator> | assign | 1 | const class:0 & |
| (size_type,const T &) | forward_list<T,Allocator> | assign | 0 | size_type |
| (size_type,const T &) | forward_list<T,Allocator> | assign | 1 | const class:0 & |
| (size_type,const T &) | list<T,Allocator> | assign | 0 | size_type |
| (size_type,const T &) | list<T,Allocator> | assign | 1 | const class:0 & |
| (size_type,const T &) | vector<T,Allocator> | assign | 0 | size_type |
| (size_type,const T &) | vector<T,Allocator> | assign | 1 | const class:0 & |
| (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 0 | size_type |
| (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 1 | const class:0 & |
| (size_type,const T &,const Allocator &) | deque<T,Allocator> | deque | 2 | const class:1 & |
| (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 0 | size_type |
| (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 1 | const class:0 & |
| (size_type,const T &,const Allocator &) | forward_list<T,Allocator> | forward_list | 2 | const class:1 & |
| (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 0 | size_type |
| (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 1 | const class:0 & |
| (size_type,const T &,const Allocator &) | list<T,Allocator> | list | 2 | const class:1 & |
| (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 0 | size_type |
| (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 1 | const class:0 & |
| (size_type,const T &,const Allocator &) | vector<T,Allocator> | vector | 2 | const class:1 & |
| (vector &&) | vector | vector | 0 | vector && |
| (vector &&,const Allocator &) | vector<T,Allocator> | vector | 0 | vector && |
| (vector &&,const Allocator &) | vector<T,Allocator> | vector | 1 | const class:1 & |
getParameterTypeName
| stl.h:49:3:49:10 | iterator | 0 | const iterator & |
| stl.h:49:3:49:10 | iterator | 0 | const iterator & |
| stl.h:49:3:49:10 | iterator | 0 | const iterator & |
| stl.h:49:3:49:10 | iterator | 0 | const iterator & |
| stl.h:49:3:49:10 | iterator | 0 | const iterator & |
| stl.h:49:3:49:10 | iterator | 0 | const iterator & |
| stl.h:49:3:49:10 | iterator | 0 | const iterator & |
| stl.h:49:3:49:10 | iterator | 0 | const iterator & |
| stl.h:52:12:52:21 | operator++ | 0 | int |
| stl.h:52:12:52:21 | operator++ | 0 | int |
| stl.h:52:12:52:21 | operator++ | 0 | int |
| stl.h:52:12:52:21 | operator++ | 0 | int |
| stl.h:52:12:52:21 | operator++ | 0 | int |
| stl.h:54:12:54:21 | operator-- | 0 | int |
| stl.h:56:8:56:17 | operator!= | 0 | iterator |
| stl.h:56:8:56:17 | operator!= | 0 | iterator |
| stl.h:56:8:56:17 | operator!= | 0 | iterator |
| stl.h:56:8:56:17 | operator!= | 0 | iterator |
| stl.h:56:8:56:17 | operator!= | 0 | iterator |
| stl.h:56:8:56:17 | operator!= | 0 | iterator |
| stl.h:59:12:59:20 | operator+ | 0 | int |
| stl.h:60:12:60:20 | operator- | 0 | int |
| stl.h:61:13:61:22 | operator+= | 0 | int |
| stl.h:61:13:61:22 | operator+= | 0 | int |
| stl.h:62:13:62:22 | operator-= | 0 | int |
| stl.h:64:18:64:27 | operator[] | 0 | int |
| stl.h:86:22:86:41 | back_insert_iterator | 0 | class:0 & |
| stl.h:86:22:86:41 | back_insert_iterator | 0 | class:0 & |
| stl.h:88:25:88:33 | operator= | 0 | value_type && |
| stl.h:88:25:88:33 | operator= | 0 | value_type && |
| stl.h:91:24:91:33 | operator++ | 0 | int |
| stl.h:91:24:91:33 | operator++ | 0 | int |
| stl.h:139:8:139:8 | basic_string | 0 | basic_string & |
| stl.h:148:3:148:14 | basic_string | 0 | const class:2 & |
| stl.h:149:33:149:44 | basic_string | 0 | const class:0 * |
| stl.h:149:33:149:44 | basic_string | 1 | const class:2 & |
| stl.h:151:16:151:20 | c_str | 0 | func:0 |
| stl.h:151:16:151:20 | c_str | 1 | func:0 |
| stl.h:151:16:151:20 | c_str | 2 | const class:2 & |
| stl.h:173:13:173:22 | operator[] | 0 | size_type |
| stl.h:175:13:175:14 | at | 0 | size_type |
| stl.h:176:35:176:44 | operator+= | 0 | size_type |
| stl.h:176:35:176:44 | operator+= | 0 | size_type |
| stl.h:177:17:177:26 | operator+= | 0 | const func:0 & |
| stl.h:178:17:178:22 | append | 0 | const class:0 * |
| stl.h:179:17:179:22 | append | 0 | const basic_string & |
| stl.h:180:17:180:22 | append | 0 | const class:0 * |
| stl.h:181:47:181:52 | append | 0 | size_type |
| stl.h:181:47:181:52 | append | 1 | class:0 |
| stl.h:182:17:182:22 | assign | 0 | func:0 |
| stl.h:182:17:182:22 | assign | 1 | func:0 |
| stl.h:183:17:183:22 | assign | 0 | const basic_string & |
| stl.h:184:47:184:52 | assign | 0 | size_type |
| stl.h:184:47:184:52 | assign | 1 | class:0 |
| stl.h:185:17:185:22 | insert | 0 | func:0 |
| stl.h:185:17:185:22 | insert | 1 | func:0 |
| stl.h:186:17:186:22 | insert | 0 | size_type |
| stl.h:186:17:186:22 | insert | 1 | const basic_string & |
| stl.h:187:17:187:22 | insert | 0 | size_type |
| stl.h:187:17:187:22 | insert | 1 | size_type |
| stl.h:187:17:187:22 | insert | 2 | class:0 |
| stl.h:188:12:188:17 | insert | 0 | size_type |
| stl.h:188:12:188:17 | insert | 1 | const class:0 * |
| stl.h:189:42:189:47 | insert | 0 | const_iterator |
| stl.h:189:42:189:47 | insert | 1 | size_type |
| stl.h:189:42:189:47 | insert | 2 | class:0 |
| stl.h:190:17:190:23 | replace | 0 | const_iterator |
| stl.h:190:17:190:23 | replace | 1 | func:0 |
| stl.h:190:17:190:23 | replace | 2 | func:0 |
| stl.h:191:17:191:23 | replace | 0 | size_type |
| stl.h:191:17:191:23 | replace | 1 | size_type |
| stl.h:191:17:191:23 | replace | 2 | const basic_string & |
| stl.h:192:13:192:16 | copy | 0 | size_type |
| stl.h:192:13:192:16 | copy | 1 | size_type |
| stl.h:192:13:192:16 | copy | 2 | size_type |
| stl.h:192:13:192:16 | copy | 3 | class:0 |
| stl.h:193:8:193:12 | clear | 0 | class:0 * |
| stl.h:193:8:193:12 | clear | 1 | size_type |
| stl.h:193:8:193:12 | clear | 2 | size_type |
| stl.h:195:8:195:11 | swap | 0 | size_type |
| stl.h:195:8:195:11 | swap | 1 | size_type |
| stl.h:214:33:214:42 | operator>> | 0 | int & |
| stl.h:217:33:217:35 | get | 0 | char_type & |
| stl.h:218:33:218:35 | get | 0 | char_type * |
| stl.h:218:33:218:35 | get | 1 | streamsize |
| stl.h:220:33:220:36 | read | 0 | char_type * |
| stl.h:220:33:220:36 | read | 1 | streamsize |
| stl.h:221:14:221:21 | readsome | 0 | char_type * |
| stl.h:221:14:221:21 | readsome | 1 | streamsize |
| stl.h:222:33:222:39 | putback | 0 | char_type |
| stl.h:225:32:225:38 | getline | 0 | char_type * |
| stl.h:225:32:225:38 | getline | 1 | streamsize |
| stl.h:226:32:226:38 | getline | 0 | char_type * |
| stl.h:226:32:226:38 | getline | 1 | streamsize |
| stl.h:226:32:226:38 | getline | 2 | char_type |
| stl.h:240:33:240:42 | operator<< | 0 | int |
| stl.h:242:33:242:35 | put | 0 | char_type |
| stl.h:243:33:243:37 | write | 0 | const char_type * |
| stl.h:243:33:243:37 | write | 1 | streamsize |
| stl.h:259:12:259:29 | basic_stringstream | 0 | const basic_string & |
| stl.h:263:23:263:31 | operator= | 0 | basic_stringstream && |
| stl.h:265:8:265:11 | swap | 0 | basic_stringstream & |
| stl.h:268:8:268:10 | str | 0 | const basic_string & |
| stl.h:293:12:293:17 | vector | 0 | const class:1 & |
| stl.h:293:12:293:17 | vector | 0 | const class:1 & |
| stl.h:293:12:293:17 | vector | 0 | const class:1 & |
| stl.h:293:12:293:17 | vector | 0 | const class:1 & |
| stl.h:293:12:293:17 | vector | 0 | const class:1 & |
| stl.h:293:12:293:17 | vector | 0 | const class:1 & |
| stl.h:294:12:294:17 | vector | 0 | size_type |
| stl.h:294:12:294:17 | vector | 0 | size_type |
| stl.h:294:12:294:17 | vector | 0 | size_type |
| stl.h:294:12:294:17 | vector | 1 | const class:1 & |
| stl.h:294:12:294:17 | vector | 1 | const class:1 & |
| stl.h:294:12:294:17 | vector | 1 | const class:1 & |
| stl.h:295:3:295:8 | vector | 0 | size_type |
| stl.h:295:3:295:8 | vector | 0 | size_type |
| stl.h:295:3:295:8 | vector | 1 | const class:0 & |
| stl.h:295:3:295:8 | vector | 1 | const class:0 & |
| stl.h:295:3:295:8 | vector | 2 | const class:1 & |
| stl.h:295:3:295:8 | vector | 2 | const class:1 & |
| stl.h:296:101:296:106 | vector | 0 | func:0 |
| stl.h:296:101:296:106 | vector | 1 | func:0 |
| stl.h:296:101:296:106 | vector | 2 | const class:1 & |
| stl.h:301:11:301:19 | operator= | 0 | const vector & |
| stl.h:302:11:302:19 | operator= | 0 | vector && |
| stl.h:303:106:303:111 | assign | 0 | func:0 |
| stl.h:303:106:303:111 | assign | 1 | func:0 |
| stl.h:306:8:306:13 | assign | 0 | size_type |
| stl.h:306:8:306:13 | assign | 0 | size_type |
| stl.h:306:8:306:13 | assign | 0 | size_type |
| stl.h:306:8:306:13 | assign | 1 | const class:0 & |
| stl.h:306:8:306:13 | assign | 1 | const class:0 & |
| stl.h:306:8:306:13 | assign | 1 | const class:0 & |
| stl.h:315:13:315:22 | operator[] | 0 | size_type |
| stl.h:315:13:315:22 | operator[] | 0 | size_type |
| stl.h:315:13:315:22 | operator[] | 0 | size_type |
| stl.h:315:13:315:22 | operator[] | 0 | size_type |
| stl.h:315:13:315:22 | operator[] | 0 | size_type |
| stl.h:315:13:315:22 | operator[] | 0 | size_type |
| stl.h:318:13:318:14 | at | 0 | size_type |
| stl.h:327:8:327:16 | push_back | 0 | const class:0 & |
| stl.h:327:8:327:16 | push_back | 0 | const class:0 & |
| stl.h:328:8:328:16 | push_back | 0 | class:0 && |
| stl.h:331:12:331:17 | insert | 0 | const_iterator |
| stl.h:331:12:331:17 | insert | 1 | class:0 && |
| stl.h:333:42:333:47 | insert | 0 | const_iterator |
| stl.h:333:42:333:47 | insert | 0 | const_iterator |
| stl.h:333:42:333:47 | insert | 1 | func:0 |
| stl.h:333:42:333:47 | insert | 1 | func:0 |
| stl.h:333:42:333:47 | insert | 2 | func:0 |
| stl.h:333:42:333:47 | insert | 2 | func:0 |
| stl.h:338:8:338:11 | swap | 0 | vector & |
| stl.h:351:12:351:21 | shared_ptr | 0 | class:0 * |
| stl.h:352:3:352:12 | shared_ptr | 0 | const shared_ptr & |
| stl.h:352:3:352:12 | shared_ptr | 0 | const shared_ptr & |
| stl.h:369:12:369:21 | unique_ptr | 0 | class:0 * |
| stl.h:396:3:396:3 | pair | 0 | const class:0 & |
| stl.h:396:3:396:3 | pair | 0 | const class:0 & |
| stl.h:396:3:396:3 | pair | 0 | const class:0 & |
| stl.h:396:3:396:3 | pair | 0 | const class:0 & |
| stl.h:396:3:396:3 | pair | 0 | const class:0 & |
| stl.h:396:3:396:3 | pair | 1 | const class:1 & |
| stl.h:396:3:396:3 | pair | 1 | const class:1 & |
| stl.h:396:3:396:3 | pair | 1 | const class:1 & |
| stl.h:396:3:396:3 | pair | 1 | const class:1 & |
| stl.h:396:3:396:3 | pair | 1 | const class:1 & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:397:30:397:33 | pair | 0 | const pair & |
| stl.h:399:8:399:11 | swap | 0 | pair & |
| stl.h:422:3:422:5 | map | 0 | const map & |
| stl.h:426:8:426:16 | operator= | 0 | const map & |
| stl.h:435:6:435:15 | operator[] | 0 | key_type && |
| stl.h:435:6:435:15 | operator[] | 0 | key_type && |
| stl.h:436:6:436:7 | at | 0 | const key_type & |
| stl.h:443:24:443:29 | insert | 0 | value_type && |
| stl.h:445:12:445:17 | insert | 0 | const_iterator |
| stl.h:445:12:445:17 | insert | 1 | value_type && |
| stl.h:452:42:452:57 | insert_or_assign | 0 | key_type && |
| stl.h:452:42:452:57 | insert_or_assign | 1 | func:0 && |
| stl.h:454:30:454:45 | insert_or_assign | 0 | const_iterator |
| stl.h:454:30:454:45 | insert_or_assign | 1 | key_type && |
| stl.h:454:30:454:45 | insert_or_assign | 2 | func:0 && |
| stl.h:456:12:456:16 | erase | 0 | iterator |
| stl.h:459:8:459:11 | swap | 0 | map & |
| stl.h:462:27:462:31 | merge | 0 | map & |
| stl.h:465:12:465:15 | find | 0 | const key_type & |
| stl.h:468:12:468:22 | lower_bound | 0 | const key_type & |
| stl.h:470:12:470:22 | upper_bound | 0 | const key_type & |
| stl.h:473:28:473:38 | equal_range | 0 | const key_type & |
| stl.h:490:3:490:15 | unordered_map | 0 | const unordered_map & |
| stl.h:490:3:490:15 | unordered_map | 0 | const unordered_map & |
| stl.h:494:18:494:26 | operator= | 0 | const unordered_map & |
| stl.h:503:16:503:25 | operator[] | 0 | key_type && |
| stl.h:503:16:503:25 | operator[] | 0 | key_type && |
| stl.h:504:16:504:17 | at | 0 | const key_type & |
| stl.h:511:24:511:29 | insert | 0 | value_type && |
| stl.h:513:12:513:17 | insert | 0 | const_iterator |
| stl.h:513:12:513:17 | insert | 1 | value_type && |
| stl.h:520:42:520:57 | insert_or_assign | 0 | key_type && |
| stl.h:520:42:520:57 | insert_or_assign | 1 | func:0 && |
| stl.h:522:30:522:45 | insert_or_assign | 0 | const_iterator |
| stl.h:522:30:522:45 | insert_or_assign | 1 | key_type && |
| stl.h:522:30:522:45 | insert_or_assign | 2 | func:0 && |
| stl.h:524:12:524:16 | erase | 0 | iterator |
| stl.h:527:8:527:11 | swap | 0 | unordered_map & |
| stl.h:530:37:530:41 | merge | 0 | unordered_map & |
| stl.h:533:12:533:15 | find | 0 | const key_type & |
| stl.h:536:28:536:38 | equal_range | 0 | const key_type & |
| stl.h:555:3:555:5 | set | 0 | const set & |
| stl.h:557:33:557:35 | set | 0 | func:0 |
| stl.h:557:33:557:35 | set | 1 | func:0 |
| stl.h:560:8:560:16 | operator= | 0 | const set & |
| stl.h:571:23:571:28 | insert | 0 | value_type && |
| stl.h:573:12:573:17 | insert | 0 | const_iterator |
| stl.h:573:12:573:17 | insert | 1 | value_type && |
| stl.h:574:38:574:43 | insert | 0 | func:0 |
| stl.h:574:38:574:43 | insert | 1 | func:0 |
| stl.h:576:12:576:16 | erase | 0 | iterator |
| stl.h:579:8:579:11 | swap | 0 | set & |
| stl.h:582:27:582:31 | merge | 0 | set & |
| stl.h:585:12:585:15 | find | 0 | const key_type & |
| stl.h:588:12:588:22 | lower_bound | 0 | const key_type & |
| stl.h:590:12:590:22 | upper_bound | 0 | const key_type & |
| stl.h:592:28:592:38 | equal_range | 0 | const key_type & |
| stl.h:609:3:609:15 | unordered_set | 0 | const unordered_set & |
| stl.h:611:33:611:45 | unordered_set | 0 | func:0 |
| stl.h:611:33:611:45 | unordered_set | 1 | func:0 |
| stl.h:611:33:611:45 | unordered_set | 2 | size_type |
| stl.h:614:18:614:26 | operator= | 0 | const unordered_set & |
| stl.h:625:24:625:29 | insert | 0 | value_type && |
| stl.h:627:12:627:17 | insert | 0 | const_iterator |
| stl.h:627:12:627:17 | insert | 1 | value_type && |
| stl.h:628:38:628:43 | insert | 0 | func:0 |
| stl.h:628:38:628:43 | insert | 1 | func:0 |
| stl.h:630:12:630:16 | erase | 0 | iterator |
| stl.h:633:8:633:11 | swap | 0 | unordered_set & |
| stl.h:636:37:636:41 | merge | 0 | unordered_set & |
| stl.h:639:12:639:15 | find | 0 | const key_type & |
| stl.h:641:28:641:38 | equal_range | 0 | const key_type & |

9
cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.ql Normal file
View File

@@ -0,0 +1,9 @@
import cpp
import semmle.code.cpp.dataflow.ExternalFlow
import ExternalFlowDebug
query predicate signatureMatches = signatureMatches_debug/5;
query predicate getSignatureParameterName = getSignatureParameterName_debug/4;
query predicate getParameterTypeName = getParameterTypeName_debug/2;

172
cpp/ql/test/library-tests/dataflow/taint-tests/vector.cpp
View File

@@ -17,20 +17,20 @@ void test_range_based_for_loop_vector(int source1) {
std::vector<int> v(100, source1);
for(int x : v) {
sink(x); // $ ast,ir
sink(x); // $ ir MISSING:ast
}
for(std::vector<int>::iterator it = v.begin(); it != v.end(); ++it) {
sink(*it); // $ ast,ir
sink(*it); // $ ir MISSING:ast
}
for(int& x : v) {
sink(x); // $ ast,ir
sink(x); // $ ir MISSING:ast
}
const std::vector<int> const_v(100, source1);
for(const int& x : const_v) {
sink(x); // $ ast,ir
sink(x); // $ ir MISSING:ast
}
}
@@ -49,40 +49,40 @@ void test_element_taint(int x) {
sink(v1.back());
v2[0] = source();
sink(v2); // $ ast,ir
sink(v2[0]); // $ ast,ir
sink(v2[1]); // $ SPURIOUS: ast,ir
sink(v2[x]); // $ ast,ir
sink(v2); // $ ir MISSING:ast
sink(v2[0]); // $ ir MISSING:ast
sink(v2[1]); // $ SPURIOUS: ir
sink(v2[x]); // $ ir MISSING:ast
v3 = v2;
sink(v3); // $ ast,ir
sink(v3[0]); // $ ast,ir
sink(v3[1]); // $ SPURIOUS: ast,ir
sink(v3[x]); // $ ast,ir
sink(v3); // $ ir MISSING:ast
sink(v3[0]); // $ ir MISSING:ast
sink(v3[1]); // $ SPURIOUS: ir
sink(v3[x]); // $ ir MISSING:ast
v4[x] = source();
sink(v4); // $ ast,ir
sink(v4[0]); // $ ast,ir
sink(v4[1]); // $ ast,ir
sink(v4[x]); // $ ast,ir
sink(v4); // $ ir MISSING:ast
sink(v4[0]); // $ ir MISSING:ast
sink(v4[1]); // $ ir MISSING:ast
sink(v4[x]); // $ ir MISSING:ast
v5.push_back(source());
sink(v5); // $ ast,ir
sink(v5.front()); // $ SPURIOUS: ast,ir
sink(v5.back()); // $ ast,ir
sink(v5); // $ ir MISSING:ast
sink(v5.front()); // $ SPURIOUS: ir
sink(v5.back()); // $ ir MISSING:ast
v6.data()[2] = source();
sink(v6); // $ ast,ir
sink(v6.data()[2]); // $ ast,ir
sink(v6); // $ ir MISSING:ast
sink(v6.data()[2]); // $ ir MISSING:ast
{
std::vector<int>::const_iterator it = v7.begin();
v7.insert(it, source());
}
sink(v7); // $ ast,ir
sink(v7.front()); // $ ast,ir
sink(v7.back()); // $ SPURIOUS: ast,ir
sink(v7); // $ ir MISSING:ast
sink(v7.front()); // $ ir MISSING:ast
sink(v7.back()); // $ SPURIOUS: ir
{
const std::vector<int> &v8c = v8;
@@ -94,10 +94,10 @@ void test_element_taint(int x) {
sink(v8.back()); // $ MISSING: ast,ir
v9.at(x) = source();
sink(v9); // $ ast,ir
sink(v9.at(0)); // $ ast,ir
sink(v9.at(1)); // $ ast,ir
sink(v9.at(x)); // $ ast,ir
sink(v9); // $ ir MISSING:ast
sink(v9.at(0)); // $ ir MISSING:ast
sink(v9.at(1)); // $ ir MISSING:ast
sink(v9.at(x)); // $ ir MISSING:ast
}
void test_vector_swap() {
@@ -106,18 +106,18 @@ void test_vector_swap() {
v1.push_back(source());
v4.push_back(source());
sink(v1); // $ ast,ir
sink(v1); // $ ir MISSING:ast
sink(v2);
sink(v3);
sink(v4); // $ ast,ir
sink(v4); // $ ir MISSING:ast
v1.swap(v2);
v3.swap(v4);
sink(v1); // $ SPURIOUS: ast
sink(v2); // $ ast,ir
sink(v3); // $ ast,ir
sink(v4); // $ SPURIOUS: ast
sink(v1);
sink(v2); // $ ir MISSING:ast
sink(v3); // $ ir MISSING:ast
sink(v4);
}
void test_vector_clear() {
@@ -127,18 +127,18 @@ void test_vector_clear() {
v2.push_back(source());
v3.push_back(source());
sink(v1); // $ ast,ir
sink(v2); // $ ast,ir
sink(v3); // $ ast,ir
sink(v1); // $ ir MISSING:ast
sink(v2); // $ ir MISSING:ast
sink(v3); // $ ir MISSING:ast
sink(v4);
v1.clear();
v2 = v2;
v3 = v4;
sink(v1); // $ SPURIOUS: ast,ir
sink(v2); // $ ast,ir
sink(v3); // $ SPURIOUS: ast
sink(v1); // $ SPURIOUS: ir
sink(v2); // $ ir MISSING:ast
sink(v3);
sink(v4);
}
@@ -159,7 +159,7 @@ void test_nested_vectors()
sink(aa[0][0]);
aa[0][0] = source();
sink(aa[0][0]); // $ ast,ir
sink(aa[0][0]); // $ ir,ast
}
{
@@ -168,7 +168,7 @@ void test_nested_vectors()
bb[0].push_back(0);
sink(bb[0][0]);
bb[0][0] = source();
sink(bb[0][0]); // $ ast,ir
sink(bb[0][0]); // $ ir MISSING:ast
}
{
@@ -177,7 +177,7 @@ void test_nested_vectors()
cc[0].push_back(0);
sink(cc[0][0]);
cc[0][0] = source();
sink(cc[0][0]); // $ ast,ir
sink(cc[0][0]); // $ ir MISSING:ast
}
{
@@ -188,7 +188,7 @@ void test_nested_vectors()
sink(dd[0].a);
sink(dd[0].b);
dd[0].a = source();
sink(dd[0].a); // $ MISSING: ast,ir
sink(dd[0].a); // $ ir MISSING: ast
sink(dd[0].b);
}
@@ -198,7 +198,7 @@ void test_nested_vectors()
ee.vs.push_back(0);
sink(ee.vs[0]);
ee.vs[0] = source();
sink(ee.vs[0]); // $ ast,ir
sink(ee.vs[0]); // $ ir MISSING:ast
}
{
@@ -209,7 +209,7 @@ void test_nested_vectors()
ff.push_back(mvc);
sink(ff[0].vs[0]);
ff[0].vs[0] = source();
sink(ff[0].vs[0]); // $ MISSING: ast,ir
sink(ff[0].vs[0]); // $ ir MISSING: ast
}
}
@@ -239,8 +239,8 @@ void test_vector_assign() {
v3.push_back(source());
sink(v1);
sink(v2); // $ ast,ir
sink(v3); // $ ast,ir
sink(v2); // $ ir MISSING:ast
sink(v3); // $ ir MISSING:ast
{
std::vector<int> v4, v5, v6;
@@ -255,10 +255,10 @@ void test_vector_assign() {
v6.assign(i1, i2);
sink(v4);
sink(v5); // $ ast,ir
sink(i1); // $ ast,ir
sink(i2); // $ ast,ir
sink(v6); // $ ast,ir
sink(v5); // $ ir MISSING:ast
sink(i1); // $ ir MISSING:ast
sink(i2); // $ ir MISSING:ast
sink(v6); // $ ir MISSING:ast
}
{
@@ -270,9 +270,9 @@ void test_vector_assign() {
v8.assign(100, ns_myFloat::source());
v9.assign(100, ns_ci_ptr::source());
sink(v7); // $ ast,ir
sink(v8); // $ ast,ir
sink(v9); // $ ast,ir
sink(v7); // $ ir MISSING:ast
sink(v8); // $ ir MISSING:ast
sink(v9); // $ ir MISSING:ast
}
}
@@ -282,14 +282,14 @@ void test_data_more() {
std::vector<int> v1, v2;
v1.push_back(source());
sink(v1); // $ ast,ir
sink(v1.data()); // $ ast,ir
sink(v1.data()[2]); // $ ast,ir
sink(v1); // $ ir MISSING:ast
sink(v1.data()); // $ ir MISSING:ast
sink(v1.data()[2]); // $ ir MISSING:ast
*(v2.data()) = ns_int::source();
sink(v2); // $ ast,ir
sink(v2.data()); // $ ast,ir
sink(v2.data()[2]); // $ ast,ir
sink(v2); // $ ir
sink(v2.data()); // $ ir MISSING:ast
sink(v2.data()[2]); // $ ir MISSING:ast
}
void sink(std::vector<int>::iterator);
@@ -305,11 +305,11 @@ void test_vector_insert() {
sink(a.insert(a.end(), b.begin(), b.end()));
sink(a);
sink(c.insert(c.end(), d.begin(), d.end())); // $ ast,ir
sink(c); // $ ast,ir
sink(c.insert(c.end(), d.begin(), d.end())); // $ ir MISSING:ast
sink(c); // $ ir MISSING:ast
sink(d.insert(d.end(), a.begin(), a.end())); // $ ast,ir
sink(d); // $ ast,ir
sink(d.insert(d.end(), a.begin(), a.end())); // $ ir MISSING:ast
sink(d); // $ ir MISSING:ast
}
void test_vector_constructors_more() {
@@ -321,9 +321,9 @@ void test_vector_constructors_more() {
std::vector<int> v4(v2.begin(), v2.end());
sink(v1);
sink(v2); // $ ast,ir
sink(v2); // $ ir MISSING:ast
sink(v3);
sink(v4); // $ ast,ir
sink(v4); // $ ir MISSING:ast
}
void taint_vector_output_iterator(std::vector<int>::iterator iter) {
@@ -339,12 +339,12 @@ void test_vector_output_iterator(int b) {
std::vector<int>::iterator i1 = v1.begin();
*i1 = source();
sink(v1); // $ ast,ir
sink(v1); // $ ir,ast
for(std::vector<int>::iterator it = v2.begin(); it != v2.end(); ++it) {
*it = source();
}
sink(v2); // $ ast,ir
sink(v2); // $ ir,ast
for(int& x : v3) {
x = source();
@@ -358,29 +358,29 @@ void test_vector_output_iterator(int b) {
std::vector<int>::iterator i5 = v5.begin();
*i5 = source();
sink(v5); // $ ast,ir
sink(v5); // $ ir,ast
*i5 = 1;
sink(v5); // $ ast,ir
sink(v5); // $ ir,ast
std::vector<int>::iterator i6 = v6.begin();
*i6 = source();
sink(v6); // $ ast,ir
sink(v6); // $ ir,ast
v6 = std::vector<int>(10);
sink(v6); // $ SPURIOUS: ast,ir
std::vector<int>::iterator i7 = v7.begin();
if(b) {
*i7 = source();
sink(v7); // $ ast,ir
sink(v7); // $ ir,ast
} else {
*i7 = 1;
sink(v7);
}
sink(v7); // $ ast,ir
sink(v7); // $ ir,ast
std::vector<int>::iterator i8 = v8.begin();
*i8 = source();
sink(v8); // $ ast,ir
sink(v8); // $ ir,ast
*i8 = 1;
sink(v8); // $ SPURIOUS: ast,ir
@@ -402,16 +402,16 @@ void test_vector_output_iterator(int b) {
std::vector<int>::iterator i12 = v12.begin();
*i12++ = 0;
*i12 = source();
sink(v12); // $ ast,ir
sink(v12); // $ ir,ast
std::vector<int>::iterator i13 = v13.begin();
*i13++ = source();
sink(v13); // $ ast,ir
sink(v13); // $ ir,ast
std::vector<int>::iterator i14 = v14.begin();
i14++;
*i14++ = source();
sink(v14); // $ ast,ir
sink(v14); // $ ir,ast
}
void test_vector_inserter(char *source_string) {
@@ -419,28 +419,28 @@ void test_vector_inserter(char *source_string) {
std::vector<std::string> out;
auto it = out.end();
*it++ = std::string(source_string);
sink(out); // $ ast,ir
sink(out); // $ ir,ast
}
{
std::vector<std::string> out;
auto it = std::back_inserter(out);
*it++ = std::string(source_string);
sink(out); // $ ast,ir
sink(out); // $ ir,ast
}
{
std::vector<int> out;
auto it = std::back_inserter(out);
*it++ = source();
sink(out); // $ ast,ir
sink(out); // $ ir,ast
}
{
std::vector<std::string> out;
auto it = std::back_inserter(out);
*++it = std::string(source_string);
sink(out); // $ ast,ir
sink(out); // $ ir,ast
}
{
@@ -470,7 +470,7 @@ void test_vector_memcpy()
sink(v);
memcpy(&v[i], &s, sizeof(int));
sink(v); // $ ast,ir
sink(v); // $ ir MISSING: ast
}
{
@@ -483,7 +483,7 @@ void test_vector_memcpy()
sink(cs);
memcpy(&cs[offs + 1], src.c_str(), len);
sink(src); // $ ast,ir
sink(cs); // $ ast,ir
sink(cs); // $ ir MISSING: ast
}
}
@@ -491,10 +491,10 @@ void test_vector_emplace() {
std::vector<int> v1(10), v2(10);
v1.emplace_back(source());
sink(v1); // $ ast,ir
sink(v1); // $ ir MISSING: ast
v2.emplace(v2.begin(), source());
sink(v2); // $ ast,ir
sink(v2); // $ ir MISSING: ast
}
void test_vector_iterator() {

4
cpp/ql/test/library-tests/syntax-zoo/dataflow-ir-consistency.expected
View File

@@ -29,8 +29,8 @@ postWithInFlow
| try_catch.cpp:7:8:7:8 | call to exception | PostUpdateNode should not be the target of local flow. |
viableImplInCallContextTooLarge
uniqueParameterNodeAtPosition
| ir.cpp:726:6:726:13 | TryCatch | 0 indirection | ir.cpp:737:22:737:22 | *s | Parameters with overlapping positions. |
| ir.cpp:726:6:726:13 | TryCatch | 0 indirection | ir.cpp:740:24:740:24 | *e | Parameters with overlapping positions. |
| ir.cpp:726:6:726:13 | TryCatch | *0 | ir.cpp:737:22:737:22 | *s | Parameters with overlapping positions. |
| ir.cpp:726:6:726:13 | TryCatch | *0 | ir.cpp:740:24:740:24 | *e | Parameters with overlapping positions. |
uniqueParameterNodePosition
uniqueContentApprox
identityLocalStep

24
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_byte_wprintf/WrongTypeFormatArguments.expected
View File

@@ -1,12 +1,12 @@
| tests.cpp:18:15:18:22 | Hello | This argument should be of type 'char *' but is of type 'char16_t *'. |
| tests.cpp:19:15:19:22 | Hello | This argument should be of type 'char *' but is of type 'wchar_t *'. |
| tests.cpp:21:15:21:21 | Hello | This argument should be of type 'char16_t *' but is of type 'char *'. |
| tests.cpp:21:15:21:21 | Hello | This argument should be of type 'wchar_t *' but is of type 'char *'. |
| tests.cpp:26:17:26:24 | Hello | This argument should be of type 'char *' but is of type 'char16_t *'. |
| tests.cpp:30:17:30:24 | Hello | This argument should be of type 'wchar_t *' but is of type 'char16_t *'. |
| tests.cpp:35:36:35:43 | Hello | This argument should be of type 'char *' but is of type 'wchar_t *'. |
| tests.cpp:39:36:39:43 | Hello | This argument should be of type 'char16_t *' but is of type 'wchar_t *'. |
| tests.cpp:42:37:42:44 | Hello | This argument should be of type 'char *' but is of type 'char16_t *'. |
| tests.cpp:43:37:43:44 | Hello | This argument should be of type 'char *' but is of type 'wchar_t *'. |
| tests.cpp:45:37:45:43 | Hello | This argument should be of type 'char16_t *' but is of type 'char *'. |
| tests.cpp:47:37:47:44 | Hello | This argument should be of type 'char16_t *' but is of type 'wchar_t *'. |
| tests.cpp:18:15:18:22 | Hello | This format specifier for type 'char *' does not match the argument type 'char16_t *'. |
| tests.cpp:19:15:19:22 | Hello | This format specifier for type 'char *' does not match the argument type 'wchar_t *'. |
| tests.cpp:21:15:21:21 | Hello | This format specifier for type 'char16_t *' does not match the argument type 'char *'. |
| tests.cpp:21:15:21:21 | Hello | This format specifier for type 'wchar_t *' does not match the argument type 'char *'. |
| tests.cpp:26:17:26:24 | Hello | This format specifier for type 'char *' does not match the argument type 'char16_t *'. |
| tests.cpp:30:17:30:24 | Hello | This format specifier for type 'wchar_t *' does not match the argument type 'char16_t *'. |
| tests.cpp:35:36:35:43 | Hello | This format specifier for type 'char *' does not match the argument type 'wchar_t *'. |
| tests.cpp:39:36:39:43 | Hello | This format specifier for type 'char16_t *' does not match the argument type 'wchar_t *'. |
| tests.cpp:42:37:42:44 | Hello | This format specifier for type 'char *' does not match the argument type 'char16_t *'. |
| tests.cpp:43:37:43:44 | Hello | This format specifier for type 'char *' does not match the argument type 'wchar_t *'. |
| tests.cpp:45:37:45:43 | Hello | This format specifier for type 'char16_t *' does not match the argument type 'char *'. |
| tests.cpp:47:37:47:44 | Hello | This format specifier for type 'char16_t *' does not match the argument type 'wchar_t *'. |

8
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_mixed_word_size/WrongTypeFormatArguments.expected
View File

@@ -1,4 +1,4 @@
| tests_32.cpp:14:16:14:23 | void_ptr | This argument should be of type 'long' but is of type 'void *'. |
| tests_32.cpp:15:15:15:15 | l | This argument should be of type 'void *' but is of type 'long'. |
| tests_64.cpp:14:16:14:23 | void_ptr | This argument should be of type 'long' but is of type 'void *'. |
| tests_64.cpp:15:15:15:15 | l | This argument should be of type 'void *' but is of type 'long'. |
| tests_32.cpp:14:16:14:23 | void_ptr | This format specifier for type 'long' does not match the argument type 'void *'. |
| tests_32.cpp:15:15:15:15 | l | This format specifier for type 'void *' does not match the argument type 'long'. |
| tests_64.cpp:14:16:14:23 | void_ptr | This format specifier for type 'long' does not match the argument type 'void *'. |
| tests_64.cpp:15:15:15:15 | l | This format specifier for type 'void *' does not match the argument type 'long'. |

124
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/WrongTypeFormatArguments.expected
View File

@@ -1,62 +1,62 @@
| format.h:16:59:16:61 | str | This argument should be of type 'int' but is of type 'char *'. |
| format.h:16:64:16:64 | i | This argument should be of type 'double' but is of type 'int'. |
| format.h:16:67:16:67 | d | This argument should be of type 'char *' but is of type 'double'. |
| linux.cpp:15:24:15:41 | call to get_template_value | This argument should be of type 'int' but is of type 'long'. |
| linux_c.c:11:15:11:18 | str3 | This argument should be of type 'char *' but is of type 'short *'. |
| pri_macros.h:15:35:15:40 | my_u64 | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:12:27:12:27 | i | This argument should be of type 'double' but is of type 'int'. |
| printf1.h:18:18:18:18 | i | This argument should be of type 'void *' but is of type 'int'. |
| printf1.h:25:22:25:22 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:27:19:27:20 | cs | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:38:18:38:30 | MYONETHOUSAND | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:44:18:44:20 | ull | This argument should be of type 'int' but is of type 'unsigned long long'. |
| printf1.h:45:18:45:20 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:46:18:46:20 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:113:17:113:17 | d | This argument should be of type 'long double' but is of type 'double'. |
| printf1.h:114:18:114:18 | d | This argument should be of type 'long double' but is of type 'double'. |
| printf1.h:147:19:147:19 | i | This argument should be of type 'long long' but is of type 'int'. |
| printf1.h:148:19:148:20 | ui | This argument should be of type 'unsigned long long' but is of type 'unsigned int'. |
| printf1.h:160:18:160:18 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:161:21:161:21 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:167:17:167:17 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:168:18:168:18 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:169:19:169:19 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:174:17:174:17 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:175:18:175:18 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:176:19:176:19 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:180:17:180:17 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:181:20:181:20 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:183:18:183:18 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:184:21:184:21 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:186:19:186:19 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:187:22:187:22 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:189:19:189:19 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:190:22:190:22 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:192:19:192:19 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:193:22:193:22 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:194:25:194:25 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:198:24:198:24 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:199:21:199:21 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:202:26:202:26 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:203:23:203:23 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:206:25:206:25 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:207:22:207:22 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:210:26:210:26 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:211:23:211:23 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:214:28:214:28 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:215:28:215:28 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:216:25:216:25 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:221:18:221:18 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:222:20:222:20 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:225:23:225:23 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:228:24:228:24 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:231:25:231:25 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:234:25:234:25 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:235:22:235:22 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:276:32:276:32 | s | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:278:17:278:17 | s | This argument should be of type 'int' but is of type 'char *'. |
| real_world.h:61:21:61:22 | & ... | This argument should be of type 'int *' but is of type 'short *'. |
| real_world.h:62:22:62:23 | & ... | This argument should be of type 'short *' but is of type 'int *'. |
| real_world.h:63:22:63:24 | & ... | This argument should be of type 'short *' but is of type 'unsigned int *'. |
| real_world.h:64:22:64:24 | & ... | This argument should be of type 'short *' but is of type 'signed int *'. |
| wide_string.h:25:18:25:20 | c | This argument should be of type 'char' but is of type 'char *'. |
| format.h:16:59:16:61 | str | This format specifier for type 'int' does not match the argument type 'char *'. |
| format.h:16:64:16:64 | i | This format specifier for type 'double' does not match the argument type 'int'. |
| format.h:16:67:16:67 | d | This format specifier for type 'char *' does not match the argument type 'double'. |
| linux.cpp:15:24:15:41 | call to get_template_value | This format specifier for type 'int' does not match the argument type 'long'. |
| linux_c.c:11:15:11:18 | str3 | This format specifier for type 'char *' does not match the argument type 'short *'. |
| pri_macros.h:15:35:15:40 | my_u64 | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:12:27:12:27 | i | This format specifier for type 'double' does not match the argument type 'int'. |
| printf1.h:18:18:18:18 | i | This format specifier for type 'void *' does not match the argument type 'int'. |
| printf1.h:25:22:25:22 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:27:19:27:20 | cs | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:38:18:38:30 | MYONETHOUSAND | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:44:18:44:20 | ull | This format specifier for type 'int' does not match the argument type 'unsigned long long'. |
| printf1.h:45:18:45:20 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:46:18:46:20 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:113:17:113:17 | d | This format specifier for type 'long double' does not match the argument type 'double'. |
| printf1.h:114:18:114:18 | d | This format specifier for type 'long double' does not match the argument type 'double'. |
| printf1.h:147:19:147:19 | i | This format specifier for type 'long long' does not match the argument type 'int'. |
| printf1.h:148:19:148:20 | ui | This format specifier for type 'unsigned long long' does not match the argument type 'unsigned int'. |
| printf1.h:160:18:160:18 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:161:21:161:21 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:167:17:167:17 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:168:18:168:18 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:169:19:169:19 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:174:17:174:17 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:175:18:175:18 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:176:19:176:19 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:180:17:180:17 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:181:20:181:20 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:183:18:183:18 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:184:21:184:21 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:186:19:186:19 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:187:22:187:22 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:189:19:189:19 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:190:22:190:22 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:192:19:192:19 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:193:22:193:22 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:194:25:194:25 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:198:24:198:24 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:199:21:199:21 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:202:26:202:26 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:203:23:203:23 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:206:25:206:25 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:207:22:207:22 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:210:26:210:26 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:211:23:211:23 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:214:28:214:28 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:215:28:215:28 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:216:25:216:25 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:221:18:221:18 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:222:20:222:20 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:225:23:225:23 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:228:24:228:24 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:231:25:231:25 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:234:25:234:25 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:235:22:235:22 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:276:32:276:32 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:278:17:278:17 | s | This format specifier for type 'int' does not match the argument type 'char *'. |
| real_world.h:61:21:61:22 | & ... | This format specifier for type 'int *' does not match the argument type 'short *'. |
| real_world.h:62:22:62:23 | & ... | This format specifier for type 'short *' does not match the argument type 'int *'. |
| real_world.h:63:22:63:24 | & ... | This format specifier for type 'short *' does not match the argument type 'unsigned int *'. |
| real_world.h:64:22:64:24 | & ... | This format specifier for type 'short *' does not match the argument type 'signed int *'. |
| wide_string.h:25:18:25:20 | c | This format specifier for type 'char' does not match the argument type 'char *'. |

4
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_two_byte_wprintf/WrongTypeFormatArguments.expected
View File

@@ -1,2 +1,2 @@
| printf.cpp:43:29:43:35 | test | This argument should be of type 'char *' but is of type 'char16_t *'. |
| printf.cpp:50:29:50:35 | test | This argument should be of type 'char16_t *' but is of type 'wchar_t *'. |
| printf.cpp:43:29:43:35 | test | This format specifier for type 'char *' does not match the argument type 'char16_t *'. |
| printf.cpp:50:29:50:35 | test | This format specifier for type 'char16_t *' does not match the argument type 'wchar_t *'. |

40
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_unsigned_chars/WrongTypeFormatArguments.expected
View File

@@ -1,20 +1,20 @@
| format.h:16:59:16:61 | str | This argument should be of type 'int' but is of type 'char *'. |
| format.h:16:64:16:64 | i | This argument should be of type 'double' but is of type 'int'. |
| format.h:16:67:16:67 | d | This argument should be of type 'char *' but is of type 'double'. |
| pri_macros.h:15:35:15:40 | my_u64 | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:12:27:12:27 | i | This argument should be of type 'double' but is of type 'int'. |
| printf1.h:18:18:18:18 | i | This argument should be of type 'void *' but is of type 'int'. |
| printf1.h:25:22:25:22 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:27:19:27:20 | cs | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:38:18:38:30 | MYONETHOUSAND | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:44:18:44:20 | ull | This argument should be of type 'int' but is of type 'unsigned long long'. |
| printf1.h:45:18:45:20 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:46:18:46:20 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:130:18:130:18 | 0 | This argument should be of type 'void *' but is of type 'int'. |
| printf1.h:168:19:168:19 | i | This argument should be of type 'long long' but is of type 'int'. |
| printf1.h:169:19:169:20 | ui | This argument should be of type 'unsigned long long' but is of type 'unsigned int'. |
| real_world.h:61:21:61:22 | & ... | This argument should be of type 'int *' but is of type 'short *'. |
| real_world.h:62:22:62:23 | & ... | This argument should be of type 'short *' but is of type 'int *'. |
| real_world.h:63:22:63:24 | & ... | This argument should be of type 'short *' but is of type 'unsigned int *'. |
| real_world.h:64:22:64:24 | & ... | This argument should be of type 'short *' but is of type 'signed int *'. |
| wide_string.h:25:18:25:20 | c | This argument should be of type 'char' but is of type 'char *'. |
| format.h:16:59:16:61 | str | This format specifier for type 'int' does not match the argument type 'char *'. |
| format.h:16:64:16:64 | i | This format specifier for type 'double' does not match the argument type 'int'. |
| format.h:16:67:16:67 | d | This format specifier for type 'char *' does not match the argument type 'double'. |
| pri_macros.h:15:35:15:40 | my_u64 | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:12:27:12:27 | i | This format specifier for type 'double' does not match the argument type 'int'. |
| printf1.h:18:18:18:18 | i | This format specifier for type 'void *' does not match the argument type 'int'. |
| printf1.h:25:22:25:22 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:27:19:27:20 | cs | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:38:18:38:30 | MYONETHOUSAND | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:44:18:44:20 | ull | This format specifier for type 'int' does not match the argument type 'unsigned long long'. |
| printf1.h:45:18:45:20 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:46:18:46:20 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:130:18:130:18 | 0 | This format specifier for type 'void *' does not match the argument type 'int'. |
| printf1.h:168:19:168:19 | i | This format specifier for type 'long long' does not match the argument type 'int'. |
| printf1.h:169:19:169:20 | ui | This format specifier for type 'unsigned long long' does not match the argument type 'unsigned int'. |
| real_world.h:61:21:61:22 | & ... | This format specifier for type 'int *' does not match the argument type 'short *'. |
| real_world.h:62:22:62:23 | & ... | This format specifier for type 'short *' does not match the argument type 'int *'. |
| real_world.h:63:22:63:24 | & ... | This format specifier for type 'short *' does not match the argument type 'unsigned int *'. |
| real_world.h:64:22:64:24 | & ... | This format specifier for type 'short *' does not match the argument type 'signed int *'. |
| wide_string.h:25:18:25:20 | c | This format specifier for type 'char' does not match the argument type 'char *'. |

74
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft/WrongTypeFormatArguments.expected
View File

@@ -1,37 +1,37 @@
| format.h:16:59:16:61 | str | This argument should be of type 'int' but is of type 'char *'. |
| format.h:16:64:16:64 | i | This argument should be of type 'double' but is of type 'int'. |
| format.h:16:67:16:67 | d | This argument should be of type 'char *' but is of type 'double'. |
| pri_macros.h:15:35:15:40 | my_u64 | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:12:27:12:27 | i | This argument should be of type 'double' but is of type 'int'. |
| printf1.h:18:18:18:18 | i | This argument should be of type 'void *' but is of type 'int'. |
| printf1.h:25:22:25:22 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:27:19:27:20 | cs | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:38:18:38:30 | MYONETHOUSAND | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:44:18:44:20 | ull | This argument should be of type 'int' but is of type 'unsigned long long'. |
| printf1.h:45:18:45:20 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:46:18:46:20 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:71:19:71:20 | st | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:72:19:72:20 | ST | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:73:19:73:22 | c_st | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:74:19:74:22 | C_ST | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:75:19:75:28 | sizeof(<expr>) | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:84:23:84:35 | ... - ... | This argument should be of type 'ssize_t' but is of type 'long long'. |
| printf1.h:116:16:116:24 | myString3 | This argument should be of type '__wchar_t *' but is of type 'int *'. |
| printf1.h:117:16:117:24 | myString4 | This argument should be of type '__wchar_t *' but is of type 'int *'. |
| printf1.h:130:18:130:18 | 0 | This argument should be of type 'void *' but is of type 'int'. |
| printf1.h:181:21:181:22 | ll | This argument should be of type 'int' but is of type 'long long'. |
| printf1.h:182:21:182:23 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:185:21:185:23 | i64 | This argument should be of type 'int' but is of type 'long long'. |
| printf1.h:186:21:186:23 | u64 | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:188:21:188:21 | i | This argument should be of type 'long long' but is of type 'int'. |
| printf1.h:189:21:189:22 | ui | This argument should be of type 'unsigned long long' but is of type 'unsigned int'. |
| printf1.h:190:21:190:21 | l | This argument should be of type 'long long' but is of type 'long'. |
| printf1.h:191:21:191:22 | ul | This argument should be of type 'unsigned long long' but is of type 'unsigned long'. |
| printf1.h:194:21:194:23 | i32 | This argument should be of type 'long long' but is of type 'int'. |
| printf1.h:195:21:195:23 | u32 | This argument should be of type 'unsigned long long' but is of type 'unsigned int'. |
| real_world.h:61:21:61:22 | & ... | This argument should be of type 'int *' but is of type 'short *'. |
| real_world.h:62:22:62:23 | & ... | This argument should be of type 'short *' but is of type 'int *'. |
| real_world.h:63:22:63:24 | & ... | This argument should be of type 'short *' but is of type 'unsigned int *'. |
| real_world.h:64:22:64:24 | & ... | This argument should be of type 'short *' but is of type 'signed int *'. |
| wide_string.h:25:18:25:20 | c | This argument should be of type 'char' but is of type 'char *'. |
| wide_string.h:29:19:29:22 | c | This argument should be of type 'wchar_t' but is of type '__wchar_t *'. |
| format.h:16:59:16:61 | str | This format specifier for type 'int' does not match the argument type 'char *'. |
| format.h:16:64:16:64 | i | This format specifier for type 'double' does not match the argument type 'int'. |
| format.h:16:67:16:67 | d | This format specifier for type 'char *' does not match the argument type 'double'. |
| pri_macros.h:15:35:15:40 | my_u64 | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:12:27:12:27 | i | This format specifier for type 'double' does not match the argument type 'int'. |
| printf1.h:18:18:18:18 | i | This format specifier for type 'void *' does not match the argument type 'int'. |
| printf1.h:25:22:25:22 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:27:19:27:20 | cs | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:38:18:38:30 | MYONETHOUSAND | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:44:18:44:20 | ull | This format specifier for type 'int' does not match the argument type 'unsigned long long'. |
| printf1.h:45:18:45:20 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:46:18:46:20 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:71:19:71:20 | st | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:72:19:72:20 | ST | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:73:19:73:22 | c_st | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:74:19:74:22 | C_ST | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:75:19:75:28 | sizeof(<expr>) | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:84:23:84:35 | ... - ... | This format specifier for type 'ssize_t' does not match the argument type 'long long'. |
| printf1.h:116:16:116:24 | myString3 | This format specifier for type '__wchar_t *' does not match the argument type 'int *'. |
| printf1.h:117:16:117:24 | myString4 | This format specifier for type '__wchar_t *' does not match the argument type 'int *'. |
| printf1.h:130:18:130:18 | 0 | This format specifier for type 'void *' does not match the argument type 'int'. |
| printf1.h:181:21:181:22 | ll | This format specifier for type 'int' does not match the argument type 'long long'. |
| printf1.h:182:21:182:23 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:185:21:185:23 | i64 | This format specifier for type 'int' does not match the argument type 'long long'. |
| printf1.h:186:21:186:23 | u64 | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:188:21:188:21 | i | This format specifier for type 'long long' does not match the argument type 'int'. |
| printf1.h:189:21:189:22 | ui | This format specifier for type 'unsigned long long' does not match the argument type 'unsigned int'. |
| printf1.h:190:21:190:21 | l | This format specifier for type 'long long' does not match the argument type 'long'. |
| printf1.h:191:21:191:22 | ul | This format specifier for type 'unsigned long long' does not match the argument type 'unsigned long'. |
| printf1.h:194:21:194:23 | i32 | This format specifier for type 'long long' does not match the argument type 'int'. |
| printf1.h:195:21:195:23 | u32 | This format specifier for type 'unsigned long long' does not match the argument type 'unsigned int'. |
| real_world.h:61:21:61:22 | & ... | This format specifier for type 'int *' does not match the argument type 'short *'. |
| real_world.h:62:22:62:23 | & ... | This format specifier for type 'short *' does not match the argument type 'int *'. |
| real_world.h:63:22:63:24 | & ... | This format specifier for type 'short *' does not match the argument type 'unsigned int *'. |
| real_world.h:64:22:64:24 | & ... | This format specifier for type 'short *' does not match the argument type 'signed int *'. |
| wide_string.h:25:18:25:20 | c | This format specifier for type 'char' does not match the argument type 'char *'. |
| wide_string.h:29:19:29:22 | c | This format specifier for type 'wchar_t' does not match the argument type '__wchar_t *'. |

70
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Microsoft_no_wchar/WrongTypeFormatArguments.expected
View File

@@ -1,35 +1,35 @@
| format.h:16:59:16:61 | str | This argument should be of type 'int' but is of type 'char *'. |
| format.h:16:64:16:64 | i | This argument should be of type 'double' but is of type 'int'. |
| format.h:16:67:16:67 | d | This argument should be of type 'char *' but is of type 'double'. |
| pri_macros.h:15:35:15:40 | my_u64 | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:12:27:12:27 | i | This argument should be of type 'double' but is of type 'int'. |
| printf1.h:18:18:18:18 | i | This argument should be of type 'void *' but is of type 'int'. |
| printf1.h:25:22:25:22 | i | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:27:19:27:20 | cs | This argument should be of type 'int' but is of type 'char *'. |
| printf1.h:38:18:38:30 | MYONETHOUSAND | This argument should be of type 'char *' but is of type 'int'. |
| printf1.h:44:18:44:20 | ull | This argument should be of type 'int' but is of type 'unsigned long long'. |
| printf1.h:45:18:45:20 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:46:18:46:20 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:71:19:71:20 | st | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:72:19:72:20 | ST | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:73:19:73:22 | c_st | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:74:19:74:22 | C_ST | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:75:19:75:28 | sizeof(<expr>) | This argument should be of type 'ssize_t' but is of type 'unsigned long long'. |
| printf1.h:84:23:84:35 | ... - ... | This argument should be of type 'ssize_t' but is of type 'long long'. |
| printf1.h:130:18:130:18 | 0 | This argument should be of type 'void *' but is of type 'int'. |
| printf1.h:155:21:155:22 | ll | This argument should be of type 'int' but is of type 'long long'. |
| printf1.h:156:21:156:23 | ull | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:159:21:159:23 | i64 | This argument should be of type 'int' but is of type 'long long'. |
| printf1.h:160:21:160:23 | u64 | This argument should be of type 'unsigned int' but is of type 'unsigned long long'. |
| printf1.h:162:21:162:21 | i | This argument should be of type 'long long' but is of type 'int'. |
| printf1.h:163:21:163:22 | ui | This argument should be of type 'unsigned long long' but is of type 'unsigned int'. |
| printf1.h:164:21:164:21 | l | This argument should be of type 'long long' but is of type 'long'. |
| printf1.h:165:21:165:22 | ul | This argument should be of type 'unsigned long long' but is of type 'unsigned long'. |
| printf1.h:168:21:168:23 | i32 | This argument should be of type 'long long' but is of type 'int'. |
| printf1.h:169:21:169:23 | u32 | This argument should be of type 'unsigned long long' but is of type 'unsigned int'. |
| real_world.h:61:21:61:22 | & ... | This argument should be of type 'int *' but is of type 'short *'. |
| real_world.h:62:22:62:23 | & ... | This argument should be of type 'short *' but is of type 'int *'. |
| real_world.h:63:22:63:24 | & ... | This argument should be of type 'short *' but is of type 'unsigned int *'. |
| real_world.h:64:22:64:24 | & ... | This argument should be of type 'short *' but is of type 'signed int *'. |
| wide_string.h:25:18:25:20 | c | This argument should be of type 'char' but is of type 'char *'. |
| wide_string.h:29:19:29:22 | c | This argument should be of type 'wchar_t' but is of type 'unsigned short *'. |
| format.h:16:59:16:61 | str | This format specifier for type 'int' does not match the argument type 'char *'. |
| format.h:16:64:16:64 | i | This format specifier for type 'double' does not match the argument type 'int'. |
| format.h:16:67:16:67 | d | This format specifier for type 'char *' does not match the argument type 'double'. |
| pri_macros.h:15:35:15:40 | my_u64 | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:12:27:12:27 | i | This format specifier for type 'double' does not match the argument type 'int'. |
| printf1.h:18:18:18:18 | i | This format specifier for type 'void *' does not match the argument type 'int'. |
| printf1.h:25:22:25:22 | i | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:27:19:27:20 | cs | This format specifier for type 'int' does not match the argument type 'char *'. |
| printf1.h:38:18:38:30 | MYONETHOUSAND | This format specifier for type 'char *' does not match the argument type 'int'. |
| printf1.h:44:18:44:20 | ull | This format specifier for type 'int' does not match the argument type 'unsigned long long'. |
| printf1.h:45:18:45:20 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:46:18:46:20 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:71:19:71:20 | st | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:72:19:72:20 | ST | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:73:19:73:22 | c_st | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:74:19:74:22 | C_ST | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:75:19:75:28 | sizeof(<expr>) | This format specifier for type 'ssize_t' does not match the argument type 'unsigned long long'. |
| printf1.h:84:23:84:35 | ... - ... | This format specifier for type 'ssize_t' does not match the argument type 'long long'. |
| printf1.h:130:18:130:18 | 0 | This format specifier for type 'void *' does not match the argument type 'int'. |
| printf1.h:155:21:155:22 | ll | This format specifier for type 'int' does not match the argument type 'long long'. |
| printf1.h:156:21:156:23 | ull | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:159:21:159:23 | i64 | This format specifier for type 'int' does not match the argument type 'long long'. |
| printf1.h:160:21:160:23 | u64 | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| printf1.h:162:21:162:21 | i | This format specifier for type 'long long' does not match the argument type 'int'. |
| printf1.h:163:21:163:22 | ui | This format specifier for type 'unsigned long long' does not match the argument type 'unsigned int'. |
| printf1.h:164:21:164:21 | l | This format specifier for type 'long long' does not match the argument type 'long'. |
| printf1.h:165:21:165:22 | ul | This format specifier for type 'unsigned long long' does not match the argument type 'unsigned long'. |
| printf1.h:168:21:168:23 | i32 | This format specifier for type 'long long' does not match the argument type 'int'. |
| printf1.h:169:21:169:23 | u32 | This format specifier for type 'unsigned long long' does not match the argument type 'unsigned int'. |
| real_world.h:61:21:61:22 | & ... | This format specifier for type 'int *' does not match the argument type 'short *'. |
| real_world.h:62:22:62:23 | & ... | This format specifier for type 'short *' does not match the argument type 'int *'. |
| real_world.h:63:22:63:24 | & ... | This format specifier for type 'short *' does not match the argument type 'unsigned int *'. |
| real_world.h:64:22:64:24 | & ... | This format specifier for type 'short *' does not match the argument type 'signed int *'. |
| wide_string.h:25:18:25:20 | c | This format specifier for type 'char' does not match the argument type 'char *'. |
| wide_string.h:29:19:29:22 | c | This format specifier for type 'wchar_t' does not match the argument type 'unsigned short *'. |

2
cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.expected
View File

@@ -3,3 +3,5 @@
| test.c:67:3:67:9 | call to strncat | Potentially unsafe call to strncat. |
| test.c:75:3:75:9 | call to strncat | Potentially unsafe call to strncat. |
| test.c:76:3:76:9 | call to strncat | Potentially unsafe call to strncat. |
| test.c:91:3:91:9 | call to strncat | Potentially unsafe call to strncat. |
| test.c:99:3:99:9 | call to strncat | Potentially unsafe call to strncat. |

17
cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c
View File

@@ -82,3 +82,20 @@ void strncat_test5(char *s) {
strncat(buf, s, len - strlen(buf) - 1); // GOOD
strncat(buf, s, len - strlen(buf)); // GOOD
}
void strncat_test6() {
{
char dest[60];
dest[0] = '\0';
// Will write `dest[0 .. 5]`
strncat(dest, "small", sizeof(dest)); // GOOD [FALSE POSITIVE]
}
{
char dest[60];
memset(dest, 'a', sizeof(dest));
dest[54] = '\0';
// Will write `dest[54 .. 59]`
strncat(dest, "small", sizeof(dest)); // GOOD [FALSE POSITIVE]
}
}

1
cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/UnsignedDifferenceExpressionComparedZero.expected
View File

@@ -13,3 +13,4 @@
| test.cpp:266:10:266:24 | ... > ... | Unsigned subtraction can never be negative. |
| test.cpp:276:11:276:19 | ... > ... | Unsigned subtraction can never be negative. |
| test.cpp:288:10:288:18 | ... > ... | Unsigned subtraction can never be negative. |
| test.cpp:312:9:312:25 | ... > ... | Unsigned subtraction can never be negative. |

25
cpp/ql/test/query-tests/Security/CWE/CWE-191/UnsignedDifferenceExpressionComparedZero/test.cpp
View File

@@ -43,7 +43,7 @@ void test(unsigned x, unsigned y, bool unknown) {
while(cond()) {
if(unknown) { y--; }
}
if(x - y > 0) { } // GOOD
x = y;
@@ -298,3 +298,26 @@ int test18() {
return (a - b > 0); // GOOD (as b = 0)
}
typedef unsigned int uint32_t;
typedef long long int64_t;
uint32_t get_limit();
uint32_t get_data();
void test19() {
// from the doc:
uint32_t limit = get_limit();
uint32_t total = 0;
while (limit - total > 0) { // BAD: if `total` is greater than `limit` this will underflow and continue executing the loop.
total += get_data();
}
while (total < limit) { // GOOD: never underflows here because there is no arithmetic.
total += get_data();
}
while ((int64_t)limit - total > 0) { // GOOD: never underflows here because the result always fits in an `int64_t`.
total += get_data();
}
}

1
cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/IteratorToExpiredContainer.expected
View File

@@ -3,3 +3,4 @@
| test.cpp:702:27:702:27 | call to operator[] | This object is destroyed at the end of the full-expression. |
| test.cpp:727:23:727:23 | call to operator[] | This object is destroyed at the end of the full-expression. |
| test.cpp:735:23:735:23 | call to operator[] | This object is destroyed at the end of the full-expression. |
| test.cpp:857:3:857:17 | pointer to ~PlusPlusReturnByValueIterator output argument | This object is destroyed at the end of the full-expression. |

56
cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
View File

@@ -801,4 +801,60 @@ void test5(int i)
for(const auto& vs : vvs) { }
++i;
} // GOOD
}
struct HasBeginAndEnd
{
~HasBeginAndEnd();
using value_type = int;
using difference_type = std::ptrdiff_t;
using pointer = int*;
using reference = int&;
using iterator_category = std::random_access_iterator_tag;
std::vector<int>::iterator begin() const;
std::vector<int>::iterator end() const;
};
HasBeginAndEnd getHasBeginAndEnd();
bool getBool();
void test6()
{
while(getBool())
{
for (const int& x : getHasBeginAndEnd()) // GOOD
{
}
}
}
struct PlusPlusReturnByValueIterator
{
using value_type = int;
using difference_type = std::ptrdiff_t;
using pointer = int *;
using reference = int &;
using iterator_category = std::forward_iterator_tag;
PlusPlusReturnByValueIterator();
PlusPlusReturnByValueIterator(PlusPlusReturnByValueIterator const &);
PlusPlusReturnByValueIterator operator++();
bool operator==(PlusPlusReturnByValueIterator other) const;
bool operator!=(PlusPlusReturnByValueIterator other) const;
reference operator*() const;
pointer operator->() const;
~PlusPlusReturnByValueIterator();
PlusPlusReturnByValueIterator begin();
};
void test7()
{
PlusPlusReturnByValueIterator it;
it.operator++(); // GOOD [FALSE POSITIVE]
it.begin();
}

10
cpp/ql/test/query-tests/Security/CWE/CWE-497/semmle/tests/ExposedSystemData.expected
View File

@@ -12,7 +12,7 @@ edges
| tests2.cpp:111:14:111:15 | *c1 [*ptr] | tests2.cpp:111:14:111:19 | *ptr | provenance | |
| tests2.cpp:111:14:111:15 | *c1 [*ptr] | tests2.cpp:111:17:111:19 | *ptr | provenance | |
| tests2.cpp:111:17:111:19 | *ptr | tests2.cpp:111:14:111:19 | *ptr | provenance | |
| tests2.cpp:120:5:120:21 | [summary param] 1 indirection in zmq_msg_init_data | tests2.cpp:120:5:120:21 | [summary param] 0 indirection in zmq_msg_init_data [Return] | provenance | |
| tests2.cpp:120:5:120:21 | [summary param] *1 in zmq_msg_init_data | tests2.cpp:120:5:120:21 | [summary param] *0 in zmq_msg_init_data [Return] | provenance | |
| tests2.cpp:134:2:134:30 | *... = ... | tests2.cpp:138:23:138:34 | *message_data | provenance | |
| tests2.cpp:134:2:134:30 | *... = ... | tests2.cpp:143:34:143:45 | *message_data | provenance | |
| tests2.cpp:134:17:134:22 | *call to getenv | tests2.cpp:134:2:134:30 | *... = ... | provenance | |
@@ -20,7 +20,7 @@ edges
| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:147:20:147:27 | *& ... | provenance | |
| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:155:32:155:39 | *& ... | provenance | |
| tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | tests2.cpp:158:20:158:27 | *& ... | provenance | |
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:120:5:120:21 | [summary param] 1 indirection in zmq_msg_init_data | provenance | |
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:120:5:120:21 | [summary param] *1 in zmq_msg_init_data | provenance | |
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument | provenance | |
| tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:26:15:26:20 | *call to getenv | provenance | |
| tests_sockets.cpp:26:15:26:20 | *call to getenv | tests_sockets.cpp:39:19:39:22 | *path | provenance | |
@@ -52,8 +52,8 @@ nodes
| tests2.cpp:111:14:111:15 | *c1 [*ptr] | semmle.label | *c1 [*ptr] |
| tests2.cpp:111:14:111:19 | *ptr | semmle.label | *ptr |
| tests2.cpp:111:17:111:19 | *ptr | semmle.label | *ptr |
| tests2.cpp:120:5:120:21 | [summary param] 0 indirection in zmq_msg_init_data [Return] | semmle.label | [summary param] 0 indirection in zmq_msg_init_data [Return] |
| tests2.cpp:120:5:120:21 | [summary param] 1 indirection in zmq_msg_init_data | semmle.label | [summary param] 1 indirection in zmq_msg_init_data |
| tests2.cpp:120:5:120:21 | [summary param] *0 in zmq_msg_init_data [Return] | semmle.label | [summary param] *0 in zmq_msg_init_data [Return] |
| tests2.cpp:120:5:120:21 | [summary param] *1 in zmq_msg_init_data | semmle.label | [summary param] *1 in zmq_msg_init_data |
| tests2.cpp:134:2:134:30 | *... = ... | semmle.label | *... = ... |
| tests2.cpp:134:17:134:22 | *call to getenv | semmle.label | *call to getenv |
| tests2.cpp:138:23:138:34 | *message_data | semmle.label | *message_data |
@@ -74,7 +74,7 @@ nodes
| tests_sysconf.cpp:36:21:36:27 | confstr output argument | semmle.label | confstr output argument |
| tests_sysconf.cpp:39:19:39:25 | *pathbuf | semmle.label | *pathbuf |
subpaths
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:120:5:120:21 | [summary param] 1 indirection in zmq_msg_init_data | tests2.cpp:120:5:120:21 | [summary param] 0 indirection in zmq_msg_init_data [Return] | tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument |
| tests2.cpp:143:34:143:45 | *message_data | tests2.cpp:120:5:120:21 | [summary param] *1 in zmq_msg_init_data | tests2.cpp:120:5:120:21 | [summary param] *0 in zmq_msg_init_data [Return] | tests2.cpp:143:24:143:31 | zmq_msg_init_data output argument |
#select
| tests2.cpp:63:13:63:26 | *call to getenv | tests2.cpp:63:13:63:26 | *call to getenv | tests2.cpp:63:13:63:26 | *call to getenv | This operation exposes system data from $@. | tests2.cpp:63:13:63:26 | *call to getenv | *call to getenv |
| tests2.cpp:64:13:64:26 | *call to getenv | tests2.cpp:64:13:64:26 | *call to getenv | tests2.cpp:64:13:64:26 | *call to getenv | This operation exposes system data from $@. | tests2.cpp:64:13:64:26 | *call to getenv | *call to getenv |

1
cpp/ql/test/query-tests/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.expected
View File

@@ -16,3 +16,4 @@
| test.cpp:151:9:151:24 | new | This allocation cannot throw. $@ is unnecessary. | test.cpp:152:15:152:18 | { ... } | This catch block |
| test.cpp:199:15:199:35 | new | This allocation cannot throw. $@ is unnecessary. | test.cpp:201:16:201:19 | { ... } | This catch block |
| test.cpp:212:14:212:34 | new | This allocation cannot throw. $@ is unnecessary. | test.cpp:213:34:213:36 | { ... } | This catch block |
| test.cpp:246:17:246:31 | new[] | This allocation cannot return null. $@ is unnecessary. | test.cpp:247:8:247:12 | ! ... | This check |

51
cpp/ql/test/query-tests/Security/CWE/CWE-570/test.cpp
View File

@@ -233,3 +233,54 @@ void test_operator_new_without_exception_spec() {
int* p = new(42, std::nothrow) int; // GOOD
if(p == nullptr) {}
}
namespace std {
void *memset(void *s, int c, size_t n);
}
// from the qhelp:
namespace qhelp {
// BAD: the allocation will throw an unhandled exception
// instead of returning a null pointer.
void bad1(std::size_t length) noexcept {
int* dest = new int[length];
if(!dest) {
return;
}
std::memset(dest, 0, length);
// ...
}
// BAD: the allocation won't throw an exception, but
// instead return a null pointer. [NOT DETECTED]
void bad2(std::size_t length) noexcept {
try {
int* dest = new(std::nothrow) int[length];
std::memset(dest, 0, length);
// ...
} catch(std::bad_alloc&) {
// ...
}
}
// GOOD: the allocation failure is handled appropriately.
void good1(std::size_t length) noexcept {
try {
int* dest = new int[length];
std::memset(dest, 0, length);
// ...
} catch(std::bad_alloc&) {
// ...
}
}
// GOOD: the allocation failure is handled appropriately.
void good2(std::size_t length) noexcept {
int* dest = new(std::nothrow) int[length];
if(!dest) {
return;
}
std::memset(dest, 0, length);
// ...
}
}

2
csharp/autobuilder/Semmle.Autobuild.CSharp/CSharpDiagnosticClassifier.cs
View File

@@ -99,7 +99,7 @@ namespace Semmle.Autobuild.CSharp
{
if (!match.Groups.TryGetValue("projectFile", out var projectFile))
throw new ArgumentException("Expected regular expression match to contain projectFile");
if (!match.Groups.TryGetValue("location", out var location))
if (!match.Groups.TryGetValue("location", out _))
throw new ArgumentException("Expected regular expression match to contain location");
var result = classifier.Results.OfType<Result>().FirstOrDefault();

6
csharp/autobuilder/Semmle.Autobuild.CSharp/DotNetRule.cs
View File

@@ -1,9 +1,7 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using Semmle.Util;
using Semmle.Util.Logging;
using Semmle.Autobuild.Shared;
using Semmle.Extraction.CSharp.DependencyFetching;
@@ -15,14 +13,14 @@ namespace Semmle.Autobuild.CSharp
/// </summary>
internal class DotNetRule : IBuildRule<CSharpAutobuildOptions>
{
public readonly List<IProjectOrSolution> FailedProjectsOrSolutions = new();
public List<IProjectOrSolution> FailedProjectsOrSolutions { get; } = [];
/// <summary>
/// A list of projects which are incompatible with DotNet.
/// </summary>
public IEnumerable<Project<CSharpAutobuildOptions>> NotDotNetProjects { get; private set; }
public DotNetRule() => NotDotNetProjects = new List<Project<CSharpAutobuildOptions>>();
public DotNetRule() => NotDotNetProjects = [];
public BuildScript Analyse(IAutobuilder<CSharpAutobuildOptions> builder, bool auto)
{

2
csharp/autobuilder/Semmle.Autobuild.Shared/BuildTools.cs
View File

@@ -18,7 +18,7 @@ namespace Semmle.Autobuild.Shared
Path = path;
ToolsVersion = version;
}
};
}
/// <summary>
/// Collection of available Visual Studio build tools.

Some files were not shown because too many files have changed in this diff Show More