Skip to content

C++: Add Taint through int -> bool casts #14904

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Nov 24, 2023

Conversation

MathiasVP
Copy link
Contributor

The final step in undoing the workaround in https://github.com/github/codeql/pull/14886/files#diff-40e2016a464c1cf96ccb2a7469f1d6d2da1768ab2f355c8beb3bd0050ecd6a18R31 we add taint-flow through the implicit integer to boolean cast generated in a snippet such as:

int x = some_int();
if(!x) { ... }

This is necessary because we generate IR that's equivalent to:

int x = some_int();
if(!(x != 0)) { ... }

and since we already have taint-flow from x to !x, the additional taint from x to x != 0 ensures that we get flow to the result of the condition.

@github-actions github-actions bot added the C++ label Nov 24, 2023
@MathiasVP MathiasVP marked this pull request as ready for review November 24, 2023 14:21
@MathiasVP MathiasVP requested a review from a team as a code owner November 24, 2023 14:21
@MathiasVP
Copy link
Contributor Author

DCA looks uneventful 🎉

@MathiasVP MathiasVP added the no-change-note-required This PR does not need a change note label Nov 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
C++ no-change-note-required This PR does not need a change note
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants