github / github/codeql

[C++] Alias analysis failure on pointer to local variable

オープン
#18,101 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
question
主要言語
CodeQL
スター
10.1k
フォーク
2.1k
平均マージ
2日 15時間
マージ済み PR(30日)
141

説明

Assigning to a local variable though a pointer appears to defeat the taint tracking. In the following example I would have expected to see a taint flow from line 16 to 17 but only the one from line 19 to 20 is reported. The taint seems to not propagate through the pointer correctly.

```cpp
int source()
{
return 2;
}

int target(int source)
{
return source;
}
int main(int argv, char **argc)
{
int a;
int *c = &a;
*c = source();
target(a); // not detected as reached

a = source();
target(a); // detected as reached

return 0;
}
```

This is the query I ran.

```ql
import cpp
import semmle.code.cpp.dataflow.new.TaintTracking

module SourceSinkCallConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
source.asExpr().(Call).getTarget().getName() = "source"
}

predicate isSink(DataFlow::Node sink) {
exists(Call call |
call.getTarget().getName() = "target" and
call.getArgument(0) = sink.asExpr()
)
}
}

module SourceSinkCallTaint = TaintTracking::Global;

from DataFlow::Node source, DataFlow::Node sink, int source_line, int sink_line
where
SourceSinkCallTaint::flow(source, sink) and
source_line = source.getLocation().getStartLine() and
sink_line = sink.getLocation().getStartLine()
select source, source_line, sink, sink_line
```

This is the output I received.

```
| source | source_line | sink | sink_line |
+----------------+-------------+------+-----------+
| call to source | 19 | a | 20 |
```

CodeQL version: 2.19.3

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。