Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Data flow: Rework reverse flow through parameters #18109

Draft
wants to merge 11 commits into
base: main
Choose a base branch
from
Draft

Data flow: Rework reverse flow through parameters #18109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
9f22b45
C#: Add tests for missing reverse flow
hvitved Nov 22, 2024
8b4969d
Data flow: Rework reverse flow through parameters
hvitved Nov 25, 2024
0ed6cdd
Ruby
hvitved Nov 26, 2024
87e275f
Swift
hvitved Nov 26, 2024
fe17511
shared
hvitved Nov 26, 2024
8bafbf5
py
hvitved Nov 26, 2024
306c7d1
wip
hvitved Nov 26, 2024
afa9a73
cpp
hvitved Nov 26, 2024
14606f4
Update expected test output
hvitved Nov 26, 2024
4f87ac3
wip
hvitved Nov 27, 2024
e853459
wip2
hvitved Nov 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -545,7 +545,7 @@ module ProductFlow {
private predicate outImpl1(Flow1::PathNode pred1, Flow1::PathNode succ1, DataFlowCall call) {
Flow1::PathGraph::edges(pred1, succ1, _, _) and
exists(ReturnKindExt returnKind |
succ1.getNode() = returnKind.getAnOutNode(call) and
succ1.getNode() = returnKind.getAnOutNode0(call) and
returnKind = getParamReturnPosition(_, pred1.asParameterReturnNode()).getKind()
)
}
Expand Down Expand Up @@ -573,7 +573,7 @@ module ProductFlow {
private predicate outImpl2(Flow2::PathNode pred2, Flow2::PathNode succ2, DataFlowCall call) {
Flow2::PathGraph::edges(pred2, succ2, _, _) and
exists(ReturnKindExt returnKind |
succ2.getNode() = returnKind.getAnOutNode(call) and
succ2.getNode() = returnKind.getAnOutNode0(call) and
returnKind = getParamReturnPosition(_, pred2.asParameterReturnNode()).getKind()
)
}
Expand Down
419 changes: 419 additions & 0 deletions ...erimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.expected
View file
Open in desktop

Large diffs are not rendered by default.

5 changes: 5 additions & 0 deletions cpp/ql/test/library-tests/dataflow/dataflow-tests/test-source-sink.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,10 +182,15 @@ irFlow
| dispatch.cpp:107:17:107:22 | call to source | dispatch.cpp:96:8:96:8 | x |
| dispatch.cpp:140:8:140:13 | call to source | dispatch.cpp:96:8:96:8 | x |
| dispatch.cpp:144:8:144:13 | call to source | dispatch.cpp:96:8:96:8 | x |
| flowOut.cpp:5:16:5:21 | call to source | flowOut.cpp:19:9:19:9 | x |
| flowOut.cpp:5:16:5:21 | call to source | flowOut.cpp:31:9:31:9 | x |
| flowOut.cpp:5:16:5:21 | call to source | flowOut.cpp:46:8:46:11 | access to array |
| flowOut.cpp:5:16:5:21 | call to source | flowOut.cpp:61:8:61:11 | access to array |
| flowOut.cpp:8:16:8:23 | call to source | flowOut.cpp:73:8:73:9 | * ... |
| flowOut.cpp:8:16:8:23 | call to source | flowOut.cpp:117:8:117:9 | * ... |
| flowOut.cpp:84:18:84:23 | call to source | flowOut.cpp:85:8:85:9 | * ... |
| flowOut.cpp:90:8:90:13 | call to source | flowOut.cpp:102:8:102:9 | * ... |
| flowOut.cpp:131:15:131:20 | call to source | flowOut.cpp:146:8:146:10 | * ... |
| flowOut.cpp:131:15:131:20 | call to source | flowOut.cpp:161:8:161:10 | * ... |
| flowOut.cpp:131:15:131:20 | call to source | flowOut.cpp:202:8:202:10 | * ... |
| flowOut.cpp:168:14:168:19 | call to source | flowOut.cpp:185:8:185:9 | * ... |
Expand Down
5 changes: 5 additions & 0 deletions cpp/ql/test/library-tests/dataflow/dataflow-tests/test.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,7 @@
testFailures
| flowOut.cpp:19:9:19:9 | x | Unexpected result: ir |
| flowOut.cpp:46:8:46:11 | access to array | Unexpected result: ir |
| flowOut.cpp:73:8:73:9 | * ... | Unexpected result: ir |
| flowOut.cpp:117:8:117:9 | * ... | Unexpected result: ir |
| flowOut.cpp:146:8:146:10 | * ... | Unexpected result: ir |
failures
2 changes: 2 additions & 0 deletions cpp/ql/test/library-tests/dataflow/fields/flow.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,4 @@
testFailures
| A.cpp:65:14:65:14 | c | Unexpected result: ast |
| A.cpp:74:14:74:14 | c | Unexpected result: ast |
failures
243 changes: 204 additions & 39 deletions cpp/ql/test/library-tests/dataflow/fields/ir-path-flow.expected
View file
Open in desktop

Large diffs are not rendered by default.

869 changes: 857 additions & 12 deletions cpp/ql/test/library-tests/dataflow/fields/path-flow.expected
View file
Open in desktop

Large diffs are not rendered by default.

23 changes: 23 additions & 0 deletions cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,15 +5,26 @@ edges
| overflowdestination.cpp:27:2:27:15 | *... = ... | overflowdestination.cpp:30:17:30:20 | *arg1 | provenance | |
| overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | *src | provenance | |
| overflowdestination.cpp:50:52:50:54 | *src | overflowdestination.cpp:50:52:50:54 | *src | provenance | |
| overflowdestination.cpp:50:52:50:54 | *src | overflowdestination.cpp:50:52:50:54 | *src [Return] | provenance | DataFlowFunction |
| overflowdestination.cpp:50:52:50:54 | *src | overflowdestination.cpp:53:15:53:17 | *src | provenance | |
| overflowdestination.cpp:50:52:50:54 | *src [Reverse] | overflowdestination.cpp:50:52:50:54 | *src [Return] | provenance | |
| overflowdestination.cpp:57:52:57:54 | *src | overflowdestination.cpp:57:52:57:54 | *src | provenance | |
| overflowdestination.cpp:57:52:57:54 | *src | overflowdestination.cpp:60:15:60:17 | *src | provenance | |
| overflowdestination.cpp:60:15:60:17 | *src | overflowdestination.cpp:60:15:60:17 | *src [Reverse] | provenance | DataFlowFunction |
| overflowdestination.cpp:60:15:60:17 | *src | overflowdestination.cpp:64:16:64:19 | *src2 | provenance | |
| overflowdestination.cpp:60:15:60:17 | *src [Reverse] | overflowdestination.cpp:57:52:57:54 | *src [Return] | provenance | |
| overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:75:30:75:32 | *src | provenance | |
| overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:76:30:76:32 | *src | provenance | |
| overflowdestination.cpp:75:30:75:32 | *src | overflowdestination.cpp:50:52:50:54 | *src | provenance | |
| overflowdestination.cpp:75:30:75:32 | *src | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument | provenance | |
| overflowdestination.cpp:75:30:75:32 | *src | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument | provenance | DataFlowFunction |
| overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument | overflowdestination.cpp:76:30:76:32 | *src | provenance | |
| overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument [Reverse] | overflowdestination.cpp:50:52:50:54 | *src [Reverse] | provenance | |
| overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument [Reverse] | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument | provenance | |
| overflowdestination.cpp:76:30:76:32 | *src | overflowdestination.cpp:57:52:57:54 | *src | provenance | |
| overflowdestination.cpp:76:30:76:32 | *src | overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument | provenance | |
| overflowdestination.cpp:76:30:76:32 | *src | overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument | provenance | DataFlowFunction |
| overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument [Reverse] | provenance | |
nodes
| main.cpp:6:27:6:30 | **argv | semmle.label | **argv |
| main.cpp:7:33:7:36 | **argv | semmle.label | **argv |
Expand All @@ -24,16 +35,28 @@ nodes
| overflowdestination.cpp:46:15:46:17 | *src | semmle.label | *src |
| overflowdestination.cpp:50:52:50:54 | *src | semmle.label | *src |
| overflowdestination.cpp:50:52:50:54 | *src | semmle.label | *src |
| overflowdestination.cpp:50:52:50:54 | *src [Return] | semmle.label | *src [Return] |
| overflowdestination.cpp:50:52:50:54 | *src [Return] | semmle.label | *src [Return] |
| overflowdestination.cpp:50:52:50:54 | *src [Reverse] | semmle.label | *src [Reverse] |
| overflowdestination.cpp:53:15:53:17 | *src | semmle.label | *src |
| overflowdestination.cpp:57:52:57:54 | *src | semmle.label | *src |
| overflowdestination.cpp:57:52:57:54 | *src | semmle.label | *src |
| overflowdestination.cpp:57:52:57:54 | *src [Return] | semmle.label | *src [Return] |
| overflowdestination.cpp:60:15:60:17 | *src | semmle.label | *src |
| overflowdestination.cpp:60:15:60:17 | *src [Reverse] | semmle.label | *src [Reverse] |
| overflowdestination.cpp:64:16:64:19 | *src2 | semmle.label | *src2 |
| overflowdestination.cpp:73:8:73:10 | fgets output argument | semmle.label | fgets output argument |
| overflowdestination.cpp:75:30:75:32 | *src | semmle.label | *src |
| overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument | semmle.label | overflowdest_test2 output argument |
| overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument [Reverse] | semmle.label | overflowdest_test2 output argument [Reverse] |
| overflowdestination.cpp:76:30:76:32 | *src | semmle.label | *src |
| overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument | semmle.label | overflowdest_test3 output argument |
subpaths
| overflowdestination.cpp:75:30:75:32 | *src | overflowdestination.cpp:50:52:50:54 | *src | overflowdestination.cpp:50:52:50:54 | *src | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument |
| overflowdestination.cpp:75:30:75:32 | *src | overflowdestination.cpp:50:52:50:54 | *src | overflowdestination.cpp:50:52:50:54 | *src [Return] | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument |
| overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument [Reverse] | overflowdestination.cpp:50:52:50:54 | *src [Reverse] | overflowdestination.cpp:50:52:50:54 | *src [Return] | overflowdestination.cpp:75:30:75:32 | overflowdest_test2 output argument |
| overflowdestination.cpp:76:30:76:32 | *src | overflowdestination.cpp:57:52:57:54 | *src | overflowdestination.cpp:57:52:57:54 | *src | overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument |
| overflowdestination.cpp:76:30:76:32 | *src | overflowdestination.cpp:57:52:57:54 | *src | overflowdestination.cpp:57:52:57:54 | *src [Return] | overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument |
#select
| overflowdestination.cpp:30:2:30:8 | call to strncpy | main.cpp:6:27:6:30 | **argv | overflowdestination.cpp:30:17:30:20 | *arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
| overflowdestination.cpp:46:2:46:7 | call to memcpy | overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | *src | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
Expand Down
Loading
Loading