Jonas Jensen
c67605f15c
Merge pull request #4230 from MathiasVP/mathiasvp/array-field-flow
...
C++: Replace `field -> object` taint rule with `ArrayContent` dataflow
2020-09-18 10:56:51 +02:00
Mathias Vorreiter Pedersen
3ef6e8a580
Merge pull request #4283 from geoffw0/stringstream4
...
C++: Model getline
2020-09-18 10:17:47 +02:00
Robert Marsh
3a83cc71fe
C++: use qualifier flow in more models
2020-09-17 18:03:02 -07:00
Robert Marsh
556ace004f
C++: use qualifiers in string constructor model
2020-09-17 17:39:50 -07:00
Robert Marsh
6b7b64d7be
C++: IR data and taint flow through qualifiers
2020-09-17 17:10:11 -07:00
Robert Marsh
f73ff988e0
C++: improve cast and ptr handling in taint test
2020-09-17 16:55:36 -07:00
Geoffrey White
5cc11f1c44
C++: Additional model for 'this' flow through chains.
2020-09-17 14:12:30 +01:00
Geoffrey White
73399cb5f7
C++: Model GetLine.
2020-09-17 14:05:43 +01:00
Geoffrey White
2c15e6f934
C++: Add test cases.
2020-09-17 13:43:07 +01:00
Mathias Vorreiter Pedersen
63afe1da78
Merge pull request #4276 from geoffw0/stringstream3
...
C++: More stringstream models.
2020-09-17 14:19:52 +02:00
Geoffrey White
4d6125841d
C++: Clean up multiply defined functions.
2020-09-17 11:48:26 +01:00
Robert Marsh
691d0f3fb2
Merge branch 'main' into rdmarsh2/cpp/output-iterators-1
...
Fix merge conflict in test expectations
2020-09-16 13:52:59 -07:00
Robert Marsh
44c5233459
C++: accept test output
2020-09-16 12:49:15 -07:00
Robert Marsh
fa0e27b2de
C++: move interprocedural iterator flow to taint
2020-09-16 12:34:52 -07:00
Geoffrey White
86404af501
Merge pull request #4270 from MathiasVP/mathiasvp/single-field-flow-fix-cwe190test
...
C++: Use underlying type when checking whether a type is a single-field struct.
2020-09-16 17:21:07 +01:00
Mathias Vorreiter Pedersen
3520b86771
C++: Accept test changes.
2020-09-16 14:51:11 +02:00
Geoffrey White
c4de071a4c
C++: Flow through swap.
2020-09-16 13:39:07 +01:00
Geoffrey White
eb7bd6e176
C++: Flow through putback.
2020-09-16 13:39:07 +01:00
Geoffrey White
7cc60a30a6
C++: Flow through get, peek, read, readsome.
2020-09-16 13:36:41 +01:00
Geoffrey White
56390c1aef
C++: Flow through operator>>.
2020-09-16 13:32:13 +01:00
Mathias Vorreiter Pedersen
7b456d6162
Merge branch 'main' into mathiasvp/array-field-flow
2020-09-16 10:45:31 +02:00
Mathias Vorreiter Pedersen
c8a3baf356
Merge pull request #4272 from jbj/dataflow-partial-access
...
C++: Add AST flow through arrays
2020-09-16 09:29:39 +02:00
Matthew Gretton-Dann
795bf0d93c
Update tests for extractor changes with ctors
2020-09-15 17:58:37 +01:00
lcartey@github.com
eaea860d3e
C++: Test for overriding existing simple range analysis ranges.
2020-09-15 15:34:48 +01:00
Jonas Jensen
78560833a1
C++: Add a test distilled from real code
...
Author: @rvermeulen.
The consistency warnings go away because `sink` is defined with a body
in this file.
2020-09-15 16:24:37 +02:00
Jonas Jensen
bdce24735c
C++: Add flow through arrays
...
This works by adding data-flow edges to skip over array expressions when
reading from arrays. On the post-update side, there was already code to
skip over array expressions when storing to arrays. That happens in
`valueToUpdate` in `AddressFlow.qll`, which needed just a small tweak to
support assignments with non-field expressions at the top-level LHS,
like `*a = ...` or `a[0] = ...`.
The new code in `AddressFlow.qll` is copy-pasted from `EscapesTree.qll`,
and there is already a note in these files saying that they share a lot
of code and must be maintained in sync.
2020-09-15 14:46:11 +02:00
Jonas Jensen
27b8dc2b13
C++: Add tests for flow through arrays
2020-09-15 14:19:34 +02:00
Mathias Vorreiter Pedersen
3005f252ca
C++: Fix annotation
2020-09-15 13:34:50 +02:00
Mathias Vorreiter Pedersen
0ba72c6685
C++: Accept changes.
2020-09-15 12:49:22 +02:00
Mathias Vorreiter Pedersen
d18dd5ab09
C++: Add testcase demonstrating the underlying problem in 6ca9c449af.
2020-09-15 12:32:15 +02:00
Jonas Jensen
25412da845
Merge pull request #4253 from geoffw0/stringstream2
...
C++: Model more stringstream features
2020-09-15 12:19:26 +02:00
Robert Marsh
5f2cafc4f5
C++: Interprocedural iterator flow
2020-09-14 14:36:19 -07:00
Mathias Vorreiter Pedersen
0c14e2b69a
C++: Fix annotations in taint.cpp
2020-09-14 23:08:50 +02:00
Mathias Vorreiter Pedersen
7cd6137b34
Merge branch 'main' into mathiasvp/array-field-flow
2020-09-14 20:45:06 +02:00
Geoffrey White
6ca9c449af
C++: Add a test demonstrating the recent regression.
2020-09-14 17:55:20 +01:00
Geoffrey White
22097a9e13
C++: Add some CWE-190 tests I had lying around.
2020-09-14 14:39:02 +01:00
Geoffrey White
6b035df660
C++: Repair taint flow from previous.
2020-09-14 10:21:43 +01:00
Jonas Jensen
021aa647c1
Merge pull request #4142 from MathiasVP/mathiasvp/read-step-without-memory-operands
...
C++: Use IR alias analysis for field flow
2020-09-14 09:37:27 +02:00
Geoffrey White
b404a339a4
C++: Correct isQualifierObject -> isQualifierAddress.
2020-09-11 16:15:47 +01:00
Mathias Vorreiter Pedersen
2d57abdcbe
Merge branch 'main' into mathiasvp/read-step-without-memory-operands
2020-09-11 12:47:29 +02:00
Geoffrey White
dd53e3fe65
C++: Fix data flow to return value.
2020-09-11 11:14:58 +01:00
Geoffrey White
597757d76f
C++: Model std::stringstream put and write.
2020-09-11 11:14:57 +01:00
Geoffrey White
66a5c38eef
C++: Model std::stringstream constructor.
2020-09-11 11:14:57 +01:00
Jonas Jensen
ad11f76ec6
C++: Always normalize bounds after a computation
...
This stops some cases of `-0.0` from propagating through the range
analysis, fixing a false positive on arvidn/libtorrent.
There seems to be no need for a corresponding change in the caller of
`getDefLowerBoundsImpl` since that predicate only contains computations
that cannot introduce negative zero.
2020-09-11 11:59:00 +02:00
Jonas Jensen
0c8e06ba68
C++: Tests for -0.0 in range analysis
2020-09-11 11:52:39 +02:00
Mathias Vorreiter Pedersen
ff09104089
Merge branch 'main' into mathiasvp/array-field-flow
2020-09-11 09:25:50 +02:00
Mathias Vorreiter Pedersen
399da6837a
Merge pull request #4227 from jbj/SimpleRangeAnalysis-NotExpr
...
C++: Support `(bool)x` and `!x` in SimpleRangeAnalysis
2020-09-11 08:59:03 +02:00
Geoffrey White
fed973f9c4
Merge pull request #4229 from MathiasVP/mathiasvp/make_shared_make_unique-models
...
C++: Add taint models for std::make_unique and std::make_shared
2020-09-10 10:46:30 +01:00
Geoffrey White
34a03ec523
Merge pull request #4213 from rdmarsh2/rdmarsh2/cpp/explicit-conversion-perf
...
C++: Improve performance of getExplicitlyConverted
2020-09-10 10:33:16 +01:00
Robert Marsh
2e187a51ae
C++: test for interprocedurl iterator flow
2020-09-09 12:45:06 -07:00
