[C++] Alias analysis failure on pointer to local variable
- Lenguaje dominante
- CodeQL
- Estrellas
- 10.1k
- Forks
- 2.1k
- Merge medio
- 2 d 15 h
- PR fusionados (30 d)
- 141
Descripción
Assigning to a local variable though a pointer appears to defeat the taint tracking. In the following example I would have expected to see a taint flow from line 16 to 17 but only the one from line 19 to 20 is reported. The taint seems to not propagate through the pointer correctly.
```cpp
int source()
{
return 2;
}
int target(int source)
{
return source;
}
int main(int argv, char **argc)
{
int a;
int *c = &a;
*c = source();
target(a); // not detected as reached
a = source();
target(a); // detected as reached
return 0;
}
```
This is the query I ran.
```ql
import cpp
import semmle.code.cpp.dataflow.new.TaintTracking
module SourceSinkCallConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr().(Call).getTarget().getName() = "source"
}
predicate isSink(DataFlow::Node sink) {
exists(Call call |
call.getTarget().getName() = "target" and
call.getArgument(0) = sink.asExpr()
)
}
}
module SourceSinkCallTaint = TaintTracking::Global;
from DataFlow::Node source, DataFlow::Node sink, int source_line, int sink_line
where
SourceSinkCallTaint::flow(source, sink) and
source_line = source.getLocation().getStartLine() and
sink_line = sink.getLocation().getStartLine()
select source, source_line, sink, sink_line
```
This is the output I received.
```
| source | source_line | sink | sink_line |
+----------------+-------------+------+-----------+
| call to source | 19 | a | 20 |
```
CodeQL version: 2.19.3
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.