diff --git a/infer/src/quandary/quandaryBO.ml b/infer/src/quandary/quandaryBO.ml index 3f28a5081..f2b612e16 100644 --- a/infer/src/quandary/quandaryBO.ml +++ b/infer/src/quandary/quandaryBO.ml @@ -55,8 +55,20 @@ let update_issues all_issues = else (q_issues, iBO_issues) ) in let matching_issues quandary_issue inferbo_issue = + let trace_end_match () = + let quandary_trace_end = List.last quandary_issue.Issue.err_data.loc_trace in + let inferbo_trace_end = List.last inferbo_issue.Issue.err_data.loc_trace in + match (quandary_trace_end, inferbo_trace_end) with + | Some quandary_trace_elem, Some inferbo_trace_elem -> + let q_loc = quandary_trace_elem.lt_loc in + let i_loc = inferbo_trace_elem.lt_loc in + SourceFile.equal q_loc.file i_loc.file && Int.equal q_loc.line i_loc.line + | _ -> + false + in SourceFile.equal quandary_issue.Issue.proc_location.file inferbo_issue.Issue.proc_location.file && Int.equal quandary_issue.Issue.proc_location.line inferbo_issue.Issue.proc_location.line + && trace_end_match () && ( (is_quandary_alloc_issue quandary_issue && is_inferbo_alloc_issue inferbo_issue) || (is_quandary_access_issue quandary_issue && is_inferbo_access_issue inferbo_issue) ) in diff --git a/infer/tests/codetoanalyze/cpp/quandaryBO/tainted_index.cpp b/infer/tests/codetoanalyze/cpp/quandaryBO/tainted_index.cpp index 3dcbf9feb..d101920dc 100644 --- a/infer/tests/codetoanalyze/cpp/quandaryBO/tainted_index.cpp +++ b/infer/tests/codetoanalyze/cpp/quandaryBO/tainted_index.cpp @@ -7,6 +7,7 @@ #include extern int __infer_taint_source(); +extern void __infer_taint_sink(int i); void basic_bad() { int arr[10]; @@ -22,11 +23,28 @@ void multi_level_sink_bad(int i) { arr[i] = 2; } +struct arg { + int taint; + int bo; +}; + +arg multi_level_source_ok() { + return {.taint = __infer_taint_source(), .bo = 12}; +} + +void multi_level_sink_ok(int taint, int bo) { + __infer_taint_sink(taint); + int arr[10]; + arr[bo] = 0; +} + void multi_level_bad() { int i = multi_level_source_bad(); multi_level_sink_bad(i); } +void multi_level_good() { int i = multi_level_source_bad(); } + void memory_alloc_bad1_FN() { int arr[__infer_taint_source()]; } void memory_alloc_bad2() {