mirror of
https://github.com/github/codeql.git
synced 2025-12-20 10:46:30 +01:00
55 lines
1.5 KiB
C++
55 lines
1.5 KiB
C++
// semmle-extractor-options: --edg --clang
|
|
|
|
int source();
|
|
void sink(int); void sink(const int *); void sink(int **); void indirect_sink(...);
|
|
|
|
struct twoIntFields {
|
|
int m1, m2;
|
|
int getFirst() { return m1; }
|
|
};
|
|
|
|
void following_pointers( // $ ast-def=sourceStruct1_ptr
|
|
int sourceArray1[],
|
|
int cleanArray1[],
|
|
twoIntFields sourceStruct1,
|
|
twoIntFields *sourceStruct1_ptr,
|
|
int (*sourceFunctionPointer)())
|
|
{
|
|
sink(sourceArray1); // $ ast,ir
|
|
|
|
sink(sourceArray1[0]); // no flow
|
|
sink(*sourceArray1); // no flow
|
|
sink(&sourceArray1); // $ ast // [should probably be taint only]
|
|
indirect_sink(&sourceArray1); // $ ast,ir
|
|
|
|
sink(sourceStruct1.m1); // no flow
|
|
sink(sourceStruct1_ptr->m1); // no flow
|
|
sink(sourceStruct1_ptr->getFirst()); // no flow
|
|
|
|
sourceStruct1_ptr->m1 = source();
|
|
sink(sourceStruct1_ptr->m1); // $ ast,ir
|
|
sink(sourceStruct1_ptr->getFirst()); // $ ast,ir
|
|
sink(sourceStruct1_ptr->m2); // no flow
|
|
sink(sourceStruct1.m1); // no flow
|
|
|
|
twoIntFields s = { source(), source() };
|
|
|
|
|
|
sink(s.m2); // $ ast,ir
|
|
|
|
twoIntFields sArray[1] = { { source(), source() } };
|
|
// TODO: fix this like above
|
|
sink(sArray[0].m2); // $ ir MISSING: ast
|
|
|
|
twoIntFields sSwapped = { .m2 = source(), .m1 = 0 };
|
|
|
|
sink(sSwapped.m2); // $ ast,ir
|
|
|
|
sink(sourceFunctionPointer()); // no flow
|
|
|
|
int stackArray[2] = { source(), source() };
|
|
stackArray[0] = source();
|
|
sink(stackArray); // $ ast,ir
|
|
indirect_sink(stackArray); // $ ast ir=50:25 ir=50:35 ir=51:19
|
|
}
|