Skip to content

C++: Proper indirection in all QL models #21908

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
MathiasVP wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

C++: Proper indirection in all QL models #21908

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ae6c503
C++: Add more indirections in models.
MathiasVP May 14, 2026
54c6f47
C++: Accept test regression.
MathiasVP May 14, 2026
6c76428
C++: Add taint model and accept test changes.
MathiasVP May 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion cpp/ql/lib/semmle/code/cpp/models/implementations/Allocation.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,10 @@ private class ReallocAllocationFunction extends AllocationFunction, DataFlowFunc
override int getReallocPtrArg() { result = reallocArg }

override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
input.isParameterDeref(this.getReallocPtrArg()) and output.isReturnValueDeref()
exists(int indirectionIndex |
input.isParameterDeref(this.getReallocPtrArg(), indirectionIndex) and
output.isReturnValueDeref(indirectionIndex)
)
}
}

Expand Down
6 changes: 3 additions & 3 deletions cpp/ql/lib/semmle/code/cpp/models/implementations/GetDelim.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ private class GetDelimFunction extends TaintFunction, AliasFunction, SideEffectF
GetDelimFunction() { this.hasGlobalName(["getdelim", "getwdelim", "__getdelim"]) }

override predicate hasTaintFlow(FunctionInput i, FunctionOutput o) {
i.isParameter(3) and o.isParameterDeref(0)
i.isParameter(3) and o.isParameterDeref(0, 2)
}

override predicate isPartialWrite(FunctionOutput o) { o.isParameterDeref(3) }
override predicate isPartialWrite(FunctionOutput o) { o.isParameterDeref(0, 2) }

override predicate parameterNeverEscapes(int index) { index = [0, 1, 3] }

Expand All @@ -38,7 +38,7 @@ private class GetDelimFunction extends TaintFunction, AliasFunction, SideEffectF
}

override predicate hasRemoteFlowSource(FunctionOutput output, string description) {
output.isParameterDeref(0) and
output.isParameterDeref(0, 2) and
description = "string read by " + this.getName()
}
}
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/models/implementations/Gets.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ private class FgetsFunction extends DataFlowFunction, TaintFunction, ArrayFuncti
override predicate isPartialWrite(FunctionOutput output) { output.isParameterDeref(2) }

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isParameter(2) and
input.isParameterDeref(2) and
output.isParameterDeref(0)
}

Expand Down
4 changes: 3 additions & 1 deletion cpp/ql/lib/semmle/code/cpp/models/implementations/IdentityFunction.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@ private class IdentityFunction extends DataFlowFunction, SideEffectFunction, Ali
// These functions simply return the argument value.
input.isParameter(0) and output.isReturnValue()
or
input.isParameterDeref(0) and output.isReturnValueDeref()
exists(int indirectionIndex |
input.isParameterDeref(0, indirectionIndex) and output.isReturnValueDeref(indirectionIndex)
)
}
}
2 changes: 1 addition & 1 deletion cpp/ql/lib/semmle/code/cpp/models/implementations/Inet.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@ private class Getaddrinfo extends TaintFunction, ArrayFunction, RemoteFlowSource

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isParameterDeref([0 .. 2]) and
output.isParameterDeref(3)
output.isParameterDeref(3, 2)
}

override predicate hasArrayInput(int bufParam) { bufParam in [0, 1] }
Expand Down
126 changes: 84 additions & 42 deletions cpp/ql/lib/semmle/code/cpp/models/implementations/Iterator.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,9 @@ private class IteratorCrementNonMemberOperatorModel extends IteratorCrementNonMe
input = getIteratorArgumentInput(this, 0) and
output.isReturnValue()
or
input.isParameterDeref(0) and output.isReturnValueDeref()
exists(int indirectionIndex |
input.isParameterDeref(0, indirectionIndex) and output.isReturnValueDeref(indirectionIndex)
)
}

override predicate hasOnlySpecificReadSideEffects() { any() }
Expand Down Expand Up @@ -205,16 +207,21 @@ private class IteratorCrementMemberOperatorModel extends IteratorCrementMemberOp
input.isQualifierAddress() and
output.isReturnValue()
or
input.isReturnValueDeref() and
output.isQualifierObject()
or
input.isQualifierObject() and
output.isReturnValueDeref()
exists(int indirectionIndex |
// reverse flow
input.isReturnValueDeref(indirectionIndex) and
output.isQualifierObject(indirectionIndex)
or
input.isQualifierObject(indirectionIndex) and
output.isReturnValueDeref(indirectionIndex)
)
}

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isQualifierObject() and
output.isReturnValueDeref()
exists(int indirectionIndex |
input.isQualifierObject(indirectionIndex) and
output.isReturnValueDeref(indirectionIndex)
)
}

override predicate hasOnlySpecificReadSideEffects() { any() }
Expand Down Expand Up @@ -286,8 +293,11 @@ private class IteratorBinaryArithmeticMemberOperatorModel extends IteratorBinary
TaintFunction
{
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isQualifierObject() and
output.isReturnValue()
exists(int indirectionIndex | input.isQualifierObject(indirectionIndex) |
output.isReturnValueDeref(indirectionIndex)
or
output.isReturnValue()
)
}
}

Expand Down Expand Up @@ -346,15 +356,23 @@ private class IteratorAssignArithmeticNonMemberOperatorModel extends IteratorAss
}

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isParameterDeref(0) and output.isReturnValueDeref()
or
// reverse flow from returned reference to the object referenced by the first parameter
input.isReturnValueDeref() and
output.isParameterDeref(0)
or
(input.isParameter(1) or input.isParameterDeref(1)) and
output.isParameterDeref(0)
exists(int indirectionIndex |
input.isParameterDeref(0, indirectionIndex) and output.isReturnValueDeref(indirectionIndex)
or
// reverse flow from returned reference to the object referenced by the first parameter
input.isReturnValueDeref(indirectionIndex) and
output.isParameterDeref(0, indirectionIndex)
or
(
input.isParameter(1) and indirectionIndex = 0
or
input.isParameterDeref(1, indirectionIndex)
) and
output.isParameterDeref(0, indirectionIndex + 1)
)
}

override predicate isPartialWrite(FunctionOutput output) { output.isParameterDeref(0, _) }
}

/**
Expand All @@ -378,16 +396,25 @@ private class IteratorAssignArithmeticMemberOperatorModel extends IteratorAssign
}

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isQualifierObject() and
output.isReturnValueDeref()
or
// reverse flow from returned reference to the qualifier
input.isReturnValueDeref() and
output.isQualifierObject()
or
(input.isParameter(0) or input.isParameterDeref(0)) and
output.isQualifierObject()
exists(int indirectionIndex |
input.isParameterDeref(0, indirectionIndex) and output.isReturnValueDeref(indirectionIndex)
or
input.isQualifierObject(indirectionIndex) and output.isReturnValueDeref(indirectionIndex)
or
// reverse flow from returned reference to the object referenced by the first parameter
input.isReturnValueDeref(indirectionIndex) and
output.isQualifierObject(indirectionIndex)
or
(
input.isParameter(0) and indirectionIndex = 0
or
input.isParameterDeref(0, indirectionIndex)
) and
output.isQualifierObject(indirectionIndex + 1)
)
}

override predicate isPartialWrite(FunctionOutput output) { output.isQualifierObject(_) }
}

/**
Expand All @@ -414,11 +441,14 @@ class IteratorPointerDereferenceMemberOperator extends MemberFunction, TaintFunc
}

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isQualifierObject() and
output.isReturnValue()
or
input.isReturnValueDeref() and
output.isQualifierObject()
exists(int indirectionIndex |
input.isQualifierObject(indirectionIndex) and
(output.isReturnValueDeref(indirectionIndex) or output.isReturnValue())
or
// reverse flow
input.isReturnValueDeref(indirectionIndex) and
output.isQualifierObject(indirectionIndex)
)
}

override predicate parameterNeverEscapes(int index) { index = -1 }
Expand Down Expand Up @@ -454,8 +484,10 @@ private class IteratorPointerDereferenceNonMemberOperatorModel extends IteratorP
input = getIteratorArgumentInput(this, 0) and
output.isReturnValue()
or
input.isReturnValueDeref() and
output.isParameterDeref(0)
exists(int indirectionIndex |
input.isReturnValueDeref(indirectionIndex) and
output.isParameterDeref(0, indirectionIndex)
)
}

override predicate parameterNeverEscapes(int index) { index = 0 }
Expand Down Expand Up @@ -488,8 +520,10 @@ private class IteratorFieldMemberOperator extends Operator, TaintFunction {
IteratorFieldMemberOperator() { this.getClassAndName("operator->") instanceof Iterator }

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isQualifierObject() and
output.isReturnValue()
exists(int indirectionIndex |
input.isQualifierObject(indirectionIndex) and
output.isReturnValueDeref(indirectionIndex) // TODO
)
}
}

Expand All @@ -502,8 +536,10 @@ private class IteratorArrayMemberOperator extends MemberFunction, TaintFunction,
IteratorArrayMemberOperator() { this.getClassAndName("operator[]") instanceof Iterator }

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isQualifierObject() and
output.isReturnValue()
exists(int indirectionIndex |
input.isQualifierObject(indirectionIndex) and
output.isReturnValueDeref(indirectionIndex) // TODO
)
}
}

Expand Down Expand Up @@ -595,8 +631,11 @@ private class IteratorAssignmentMemberOperatorModel extends IteratorAssignmentMe
TaintFunction, SideEffectFunction, AliasFunction
{
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
(input.isParameterDeref(0) or input.isParameter(0)) and
output.isQualifierObject()
exists(int indirectionIndex | output.isQualifierObject(indirectionIndex + 1) |
input.isParameterDeref(0, indirectionIndex)
or
input.isParameter(0) and indirectionIndex = 0
)
}

override predicate hasOnlySpecificReadSideEffects() { any() }
Expand Down Expand Up @@ -669,8 +708,11 @@ private class BeginOrEndFunctionModels extends BeginOrEndFunction, TaintFunction
GetIteratorFunction, AliasFunction, SideEffectFunction
{
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isQualifierObject() and
output.isReturnValue()
exists(int indirectionIndex | input.isQualifierObject(indirectionIndex) |
// output.isReturnValue()
// or
output.isReturnValueDeref(indirectionIndex) // TODO
)
}

override predicate getsIterator(FunctionInput input, FunctionOutput output) {
Expand Down
28 changes: 16 additions & 12 deletions cpp/ql/lib/semmle/code/cpp/models/implementations/MemberFunction.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,12 +65,14 @@ private class MoveConstructorModel extends MoveConstructor, DataFlowFunction {
private class CopyAssignmentOperatorModel extends CopyAssignmentOperator, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// taint flow from argument to self
input.isParameterDeref(0) and
output.isQualifierObject()
or
// taint flow from argument to return value
input.isParameterDeref(0) and
output.isReturnValueDeref()
exists(int indirectionIndex |
input.isParameterDeref(0, indirectionIndex) and
output.isQualifierObject(indirectionIndex)
or
// taint flow from argument to return value
input.isParameterDeref(0, indirectionIndex) and
output.isReturnValueDeref(indirectionIndex)
)
// TODO: it would be more accurate to model copy assignment as data flow
}
}
Expand All @@ -81,12 +83,14 @@ private class CopyAssignmentOperatorModel extends CopyAssignmentOperator, TaintF
private class MoveAssignmentOperatorModel extends MoveAssignmentOperator, TaintFunction {
override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
// taint flow from argument to self
input.isParameterDeref(0) and
output.isQualifierObject()
or
// taint flow from argument to return value
input.isParameterDeref(0) and
output.isReturnValueDeref()
exists(int indirectionIndex |
input.isParameterDeref(0, indirectionIndex) and
output.isQualifierObject(indirectionIndex)
or
// taint flow from argument to return value
input.isParameterDeref(0, indirectionIndex) and
output.isReturnValueDeref(indirectionIndex)
)
// TODO: it would be more accurate to model move assignment as data flow
}
}
12 changes: 7 additions & 5 deletions cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,11 +53,13 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
override predicate hasArrayOutput(int bufParam) { bufParam = this.getParamDest() }

override predicate hasDataFlow(FunctionInput input, FunctionOutput output) {
input.isParameterDeref(this.getParamSrc()) and
output.isParameterDeref(this.getParamDest())
or
input.isParameterDeref(this.getParamSrc()) and
output.isReturnValueDeref()
exists(int indirectionIndex |
input.isParameterDeref(this.getParamSrc(), indirectionIndex) and
output.isParameterDeref(this.getParamDest(), indirectionIndex)
or
input.isParameterDeref(this.getParamSrc(), indirectionIndex) and
output.isReturnValueDeref(indirectionIndex)
)
or
input.isParameter(this.getParamDest()) and
output.isReturnValue()
Expand Down
6 changes: 4 additions & 2 deletions cpp/ql/lib/semmle/code/cpp/models/implementations/Scanf.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,10 @@ abstract private class ScanfFunctionModel extends ArrayFunction, TaintFunction,
int getArgsStartPosition() { result = this.getNumberOfParameters() }

override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
input.isParameterDeref(this.(ScanfFunction).getInputParameterIndex()) and
output.isParameterDeref(any(int i | i >= this.getArgsStartPosition()))
exists(int indirectionIndex |
input.isParameterDeref(this.(ScanfFunction).getInputParameterIndex(), indirectionIndex) and
output.isParameterDeref(any(int i | i >= this.getArgsStartPosition()), indirectionIndex)
)
}

override predicate parameterNeverEscapes(int index) {
Expand Down
Loading
Loading