hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Correct StrCpy.hasTaintFlow.

Browse Source
This commit is contained in:
Geoffrey White
2020-06-23 14:16:46 +01:00
parent c3d275d0e7
commit d259e8e8df
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cpp/ql/src/semmle/code/cpp/models/implementations/Strcpy.qll
View File

@@ -93,9 +93,11 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
}
override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
not exists(getParamSize()) and
input.isParameterDeref(getParamSrc()) and
output.isParameterDeref(getParamDest())
or
not exists(getParamSize()) and
input.isParameterDeref(getParamSrc()) and
output.isReturnValueDeref()
or
@@ -106,7 +108,8 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// these may do only a partial copy of the input buffer to the output
// buffer
input.isParameter(getParamSize()) and
exists(getParamSize()) and
input.isParameter(getParamSrc()) and
(
output.isParameterDeref(getParamDest()) or
output.isReturnValueDeref()