-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
30 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1 +1,31 @@ | ||
/** | ||
* @kind path-problem | ||
*/ | ||
|
||
import cpp | ||
import semmle.code.cpp.dataflow.TaintTracking | ||
import DataFlow::PathGraph | ||
class NetworkByteSwap extends Expr { | ||
NetworkByteSwap () { | ||
exists(MacroInvocation mi | | ||
mi.getExpr() = this and | ||
mi.getMacroName() in ["ntohll", "ntohs", "ntohl"] | ||
) | ||
} | ||
} | ||
class Config extends TaintTracking::Configuration { | ||
Config() { this = "NetworkToMemFuncLength" } | ||
|
||
override predicate isSource(DataFlow::Node source) { | ||
source.asExpr() instanceof NetworkByteSwap | ||
} | ||
override predicate isSink(DataFlow::Node sink) { | ||
exists(Function f | | ||
f.hasName("memcpy") | ||
) | ||
} | ||
} | ||
|
||
from Config cfg, DataFlow::PathNode source, DataFlow::PathNode sink | ||
where cfg.hasFlowPath(source, sink) | ||
select sink, source, sink, "Network byte swap flows to memcpy" |
28bee4a
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
1 query changed between
58d2045
and28bee4a
after push torefs/heads/main
:10_taint_tracking.ql
Results for
10_taint_tracking.ql
: incorrect (4542 results):Your query is selecting unexpected results
Expected query to produce 13 results
Unexpected results (first 10 only):
new_buf [inner post update]
new_buf [inner post update]
input_buffer [inner post update]
nfs_path [inner post update]
varvalue
varvalue
bytes
bytes
mem
mem