Skip to content

Commit 06f5720

Browse files
geoffw0geoffw0
committed
C++: Add taint tests of formatting functions.
1 parent 8c00671 commit 06f5720

2 files changed

Lines changed: 208 additions & 0 deletions

File tree

‎cpp/ql/test/library-tests/dataflow/taint-tests/format.cpp‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
2+
typedef unsigned long size_t;
3+
typedef struct {} FILE;
4+
5+
int snprintf(char *s, size_t n, const char *format, ...);
6+
int sprintf(char *s, const char *format, ...);
7+
int swprintf(wchar_t *s, size_t n, const wchar_t *format, ...);
8+
9+
typedef void *va_list;
10+
#define va_start(ap, parmN)
11+
#define va_end(ap)
12+
#define va_arg(ap, type) ((type)0)
13+
14+
int vsnprintf(char *s, size_t n, const char *format, va_list arg);
15+
16+
int mysprintf(char *s, size_t n, const char *format, ...)
17+
{
18+
va_list args;
19+
va_start(args, format);
20+
vsnprintf(s, n, format, args);
21+
va_end(args);
22+
}
23+
24+
int sscanf(const char *s, const char *format, ...);
25+
26+
// ----------
27+
28+
int source();
29+
void sink(...) {};
30+
31+
namespace string
32+
{
33+
char *source();
34+
};
35+
36+
namespace wstring
37+
{
38+
wchar_t *source();
39+
};
40+
41+
// ----------
42+
43+
void test1()
44+
{
45+
{
46+
char buffer[256] = {0};
47+
sink(snprintf(buffer, 256, "%s", "Hello."));
48+
sink(buffer);
49+
}
50+
{
51+
char buffer[256] = {0};
52+
sink(snprintf(buffer, 256, "%s", string::source()));
53+
sink(buffer); // tainted [NOT DETECTED]
54+
}
55+
{
56+
char buffer[256] = {0};
57+
sink(snprintf(buffer, 256, string::source(), "Hello."));
58+
sink(buffer); // tainted [NOT DETECTED]
59+
}
60+
{
61+
char buffer[256] = {0};
62+
sink(snprintf(buffer, 256, "%s %s %s", "a", "b", string::source()));
63+
sink(buffer); // tainted [NOT DETECTED]
64+
}
65+
{
66+
char buffer[256] = {0};
67+
sink(snprintf(buffer, 256, "%.*s", 10, string::source()));
68+
sink(buffer); // tainted [NOT DETECTED]
69+
}
70+
71+
{
72+
char buffer[256] = {0};
73+
sink(snprintf(buffer, 256, "%i", 0));
74+
sink(buffer);
75+
}
76+
{
77+
char buffer[256] = {0};
78+
sink(snprintf(buffer, 256, "%i", source()));
79+
sink(buffer); // tainted
80+
}
81+
{
82+
char buffer[256] = {0};
83+
sink(snprintf(buffer, 256, "%.*s", source(), "Hello."));
84+
sink(buffer); // tainted
85+
}
86+
87+
{
88+
char buffer[256] = {0};
89+
sink(snprintf(buffer, 256, "%p", string::source()));
90+
sink(buffer);
91+
}
92+
93+
{
94+
char buffer[256] = {0};
95+
sink(sprintf(buffer, "%s", string::source()));
96+
sink(buffer); // tainted [NOT DETECTED]
97+
}
98+
{
99+
char buffer[256] = {0};
100+
sink(sprintf(buffer, "%ls", wstring::source()));
101+
sink(buffer); // tainted [NOT DETECTED]
102+
}
103+
{
104+
wchar_t wbuffer[256] = {0};
105+
sink(swprintf(wbuffer, 256, L"%s", wstring::source()));
106+
sink(wbuffer); // tainted [NOT DETECTED]
107+
}
108+
{
109+
char buffer[256] = {0};
110+
sink(mysprintf(buffer, 256, "%s", string::source()));
111+
sink(buffer); // tainted [NOT DETECTED]
112+
}
113+
114+
{
115+
int i = 0;
116+
sink(sscanf("123", "%i", &i));
117+
sink(i);
118+
}
119+
{
120+
int i = 0;
121+
sink(sscanf(string::source(), "%i", &i));
122+
sink(i); // tainted [NOT DETECTED]
123+
}
124+
{
125+
char buffer[256] = {0};
126+
sink(sscanf("Hello.", "%s", &buffer));
127+
sink(buffer);
128+
}
129+
{
130+
char buffer[256] = {0};
131+
sink(sscanf(string::source(), "%s", &buffer));
132+
sink(buffer); // tainted [NOT DETECTED]
133+
}
134+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,80 @@
33
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
44
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
55
| file://:0:0:0:0 | p#0 | file://:0:0:0:0 | p#0 | |
6+
| format.cpp:16:21:16:21 | s | format.cpp:20:13:20:13 | s | |
7+
| format.cpp:16:31:16:31 | n | format.cpp:20:16:20:16 | n | |
8+
| format.cpp:16:46:16:51 | format | format.cpp:20:19:20:24 | format | |
9+
| format.cpp:18:10:18:13 | args | format.cpp:20:27:20:30 | args | |
10+
| format.cpp:46:21:46:24 | {...} | format.cpp:47:17:47:22 | buffer | |
11+
| format.cpp:46:21:46:24 | {...} | format.cpp:48:8:48:13 | buffer | |
12+
| format.cpp:46:23:46:23 | 0 | format.cpp:46:21:46:24 | {...} | TAINT |
13+
| format.cpp:47:17:47:22 | ref arg buffer | format.cpp:48:8:48:13 | buffer | |
14+
| format.cpp:51:21:51:24 | {...} | format.cpp:52:17:52:22 | buffer | |
15+
| format.cpp:51:21:51:24 | {...} | format.cpp:53:8:53:13 | buffer | |
16+
| format.cpp:51:23:51:23 | 0 | format.cpp:51:21:51:24 | {...} | TAINT |
17+
| format.cpp:52:17:52:22 | ref arg buffer | format.cpp:53:8:53:13 | buffer | |
18+
| format.cpp:56:21:56:24 | {...} | format.cpp:57:17:57:22 | buffer | |
19+
| format.cpp:56:21:56:24 | {...} | format.cpp:58:8:58:13 | buffer | |
20+
| format.cpp:56:23:56:23 | 0 | format.cpp:56:21:56:24 | {...} | TAINT |
21+
| format.cpp:57:17:57:22 | ref arg buffer | format.cpp:58:8:58:13 | buffer | |
22+
| format.cpp:61:21:61:24 | {...} | format.cpp:62:17:62:22 | buffer | |
23+
| format.cpp:61:21:61:24 | {...} | format.cpp:63:8:63:13 | buffer | |
24+
| format.cpp:61:23:61:23 | 0 | format.cpp:61:21:61:24 | {...} | TAINT |
25+
| format.cpp:62:17:62:22 | ref arg buffer | format.cpp:63:8:63:13 | buffer | |
26+
| format.cpp:66:21:66:24 | {...} | format.cpp:67:17:67:22 | buffer | |
27+
| format.cpp:66:21:66:24 | {...} | format.cpp:68:8:68:13 | buffer | |
28+
| format.cpp:66:23:66:23 | 0 | format.cpp:66:21:66:24 | {...} | TAINT |
29+
| format.cpp:67:17:67:22 | ref arg buffer | format.cpp:68:8:68:13 | buffer | |
30+
| format.cpp:72:21:72:24 | {...} | format.cpp:73:17:73:22 | buffer | |
31+
| format.cpp:72:21:72:24 | {...} | format.cpp:74:8:74:13 | buffer | |
32+
| format.cpp:72:23:72:23 | 0 | format.cpp:72:21:72:24 | {...} | TAINT |
33+
| format.cpp:73:17:73:22 | ref arg buffer | format.cpp:74:8:74:13 | buffer | |
34+
| format.cpp:77:21:77:24 | {...} | format.cpp:78:17:78:22 | buffer | |
35+
| format.cpp:77:21:77:24 | {...} | format.cpp:79:8:79:13 | buffer | |
36+
| format.cpp:77:23:77:23 | 0 | format.cpp:77:21:77:24 | {...} | TAINT |
37+
| format.cpp:78:17:78:22 | ref arg buffer | format.cpp:79:8:79:13 | buffer | |
38+
| format.cpp:82:21:82:24 | {...} | format.cpp:83:17:83:22 | buffer | |
39+
| format.cpp:82:21:82:24 | {...} | format.cpp:84:8:84:13 | buffer | |
40+
| format.cpp:82:23:82:23 | 0 | format.cpp:82:21:82:24 | {...} | TAINT |
41+
| format.cpp:83:17:83:22 | ref arg buffer | format.cpp:84:8:84:13 | buffer | |
42+
| format.cpp:88:21:88:24 | {...} | format.cpp:89:17:89:22 | buffer | |
43+
| format.cpp:88:21:88:24 | {...} | format.cpp:90:8:90:13 | buffer | |
44+
| format.cpp:88:23:88:23 | 0 | format.cpp:88:21:88:24 | {...} | TAINT |
45+
| format.cpp:89:17:89:22 | ref arg buffer | format.cpp:90:8:90:13 | buffer | |
46+
| format.cpp:94:21:94:24 | {...} | format.cpp:95:16:95:21 | buffer | |
47+
| format.cpp:94:21:94:24 | {...} | format.cpp:96:8:96:13 | buffer | |
48+
| format.cpp:94:23:94:23 | 0 | format.cpp:94:21:94:24 | {...} | TAINT |
49+
| format.cpp:95:16:95:21 | ref arg buffer | format.cpp:96:8:96:13 | buffer | |
50+
| format.cpp:99:21:99:24 | {...} | format.cpp:100:16:100:21 | buffer | |
51+
| format.cpp:99:21:99:24 | {...} | format.cpp:101:8:101:13 | buffer | |
52+
| format.cpp:99:23:99:23 | 0 | format.cpp:99:21:99:24 | {...} | TAINT |
53+
| format.cpp:100:16:100:21 | ref arg buffer | format.cpp:101:8:101:13 | buffer | |
54+
| format.cpp:104:25:104:28 | {...} | format.cpp:105:17:105:23 | wbuffer | |
55+
| format.cpp:104:25:104:28 | {...} | format.cpp:106:8:106:14 | wbuffer | |
56+
| format.cpp:104:27:104:27 | 0 | format.cpp:104:25:104:28 | {...} | TAINT |
57+
| format.cpp:105:17:105:23 | ref arg wbuffer | format.cpp:106:8:106:14 | wbuffer | |
58+
| format.cpp:109:21:109:24 | {...} | format.cpp:110:18:110:23 | buffer | |
59+
| format.cpp:109:21:109:24 | {...} | format.cpp:111:8:111:13 | buffer | |
60+
| format.cpp:109:23:109:23 | 0 | format.cpp:109:21:109:24 | {...} | TAINT |
61+
| format.cpp:110:18:110:23 | ref arg buffer | format.cpp:111:8:111:13 | buffer | |
62+
| format.cpp:115:10:115:11 | 0 | format.cpp:116:29:116:29 | i | |
63+
| format.cpp:115:10:115:11 | 0 | format.cpp:117:8:117:8 | i | |
64+
| format.cpp:116:28:116:29 | ref arg & ... | format.cpp:117:8:117:8 | i | |
65+
| format.cpp:116:29:116:29 | i | format.cpp:116:28:116:29 | & ... | |
66+
| format.cpp:120:10:120:11 | 0 | format.cpp:121:40:121:40 | i | |
67+
| format.cpp:120:10:120:11 | 0 | format.cpp:122:8:122:8 | i | |
68+
| format.cpp:121:39:121:40 | ref arg & ... | format.cpp:122:8:122:8 | i | |
69+
| format.cpp:121:40:121:40 | i | format.cpp:121:39:121:40 | & ... | |
70+
| format.cpp:125:21:125:24 | {...} | format.cpp:126:32:126:37 | buffer | |
71+
| format.cpp:125:21:125:24 | {...} | format.cpp:127:8:127:13 | buffer | |
72+
| format.cpp:125:23:125:23 | 0 | format.cpp:125:21:125:24 | {...} | TAINT |
73+
| format.cpp:126:31:126:37 | ref arg & ... | format.cpp:127:8:127:13 | buffer | |
74+
| format.cpp:126:32:126:37 | buffer | format.cpp:126:31:126:37 | & ... | |
75+
| format.cpp:130:21:130:24 | {...} | format.cpp:131:40:131:45 | buffer | |
76+
| format.cpp:130:21:130:24 | {...} | format.cpp:132:8:132:13 | buffer | |
77+
| format.cpp:130:23:130:23 | 0 | format.cpp:130:21:130:24 | {...} | TAINT |
78+
| format.cpp:131:39:131:45 | ref arg & ... | format.cpp:132:8:132:13 | buffer | |
79+
| format.cpp:131:40:131:45 | buffer | format.cpp:131:39:131:45 | & ... | |
680
| taint.cpp:4:27:4:33 | source1 | taint.cpp:6:13:6:19 | source1 | |
781
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:5:8:5:13 | clean1 | |
882
| taint.cpp:4:40:4:45 | clean1 | taint.cpp:6:3:6:8 | clean1 | |

0 commit comments

Comments
 (0)