Step 10

10_taint_tracking.ql

@@ -1 +1,36 @@
+/**
+ * @kind path-problem
+ */
+
+import cpp
+import semmle.code.cpp.dataflow.TaintTracking
+import DataFlow::PathGraph
+
+class NetworkByteSwap extends Expr {
+    NetworkByteSwap() {
+        exists(MacroInvocation invocation | 
+            invocation.getMacroName() in ["ntohs", "ntohl", "ntohll"] and
+            invocation.getExpr() = this
+        )
+    }
+}
+
+class Config extends TaintTracking::Configuration {
+    Config() {this = "NetworkToMemFuncLength"}
+
+    override predicate isSource(DataFlow::Node source) {
+        source.asExpr() instanceof NetworkByteSwap
+    }
+
+    override predicate isSink(DataFlow::Node sink) {
+        exists(FunctionCall call |
+            call.getTarget().getName() = "memcpy" and
+            call.getArgument(2) = sink.asExpr()
+        )
+    }
+}
+
+from Config cfg, DataFlow::PathNode source, DataFlow::PathNode sink
+where cfg.hasFlowPath(source, sink)
+select sink, source, sink, "Network byte swap flows to memcpy"
 

4_memcpy_definitions.ql

@@ -1 +1,5 @@
+import cpp
 
+from Function func
+where func.getName() = "memcpy"
+select func

5_macro_definitions.ql

@@ -1,2 +1,5 @@
+import cpp
 
-
+from Macro macro
+where macro.getName() in ["ntohs", "ntohl", "ntohll"]
+select macro

6_memcpy_calls.ql

@@ -1 +1,5 @@
+import cpp
 
+from FunctionCall call
+where call.getTarget().getName() = "memcpy"
+select call

7_macro_invocations.ql

@@ -1 +1,5 @@
+import cpp
 
+from MacroInvocation invocation
+where invocation.getMacroName() in ["ntohs", "ntohl", "ntohll"]
+select invocation

8_macro_expressions.ql

@@ -1 +1,6 @@
 
+import cpp
+
+from MacroInvocation invocation
+where invocation.getMacroName() in ["ntohs", "ntohl", "ntohll"]
+select invocation.getExpr()

9_class_network_byteswap.ql

@@ -1 +1,12 @@
+import cpp
 
+class NetworkByteSwap extends Expr {
+    NetworkByteSwap() {
+        exists(MacroInvocation invocation | 
+            invocation.getMacroName() in ["ntohs", "ntohl", "ntohll"] and
+            invocation.getExpr() = this
+        )
+    }
+}
+
+from NetworkByteSwap n select n