[quandary] add more exec sinks

Reviewed By: the-st0rm

Differential Revision: D5063078

fbshipit-source-id: 8c831b5

infer/src/quandary/ClangTrace.ml

@@ -145,7 +145,7 @@ module SinkKind = struct
     | Typ.Procname.C _ ->
         begin
           match Typ.Procname.to_string pname with
-          | "execl" | "execlp" | "execle" | "execv" | "execvp" ->
+          | "execl" | "execlp" | "execle" | "execv" | "execve" | "execvp" | "system" ->
               taint_all actuals ShellExec ~report_reachable:false
           | "brk" | "calloc" | "malloc" | "realloc" | "sbrk" ->
               taint_all actuals Allocation ~report_reachable:false

infer/tests/codetoanalyze/cpp/quandary/execs.cpp

@@ -71,6 +71,12 @@ int callExecBad() {
       return execv(NULL, arrSource);
     case 11:
       return execvp(NULL, arrSource);
+    case 12:
+      return execve(stringSource, NULL, NULL);
+    case 13:
+      return execve(NULL, arrSource, NULL);
+    case 14:
+      return system(stringSource);
   }
   return 0;
 }

infer/tests/codetoanalyze/cpp/quandary/issues.exp

@@ -29,6 +29,9 @@ codetoanalyze/cpp/quandary/execs.cpp, execs::callExecBad, 21, QUANDARY_TAINT_ERR
 codetoanalyze/cpp/quandary/execs.cpp, execs::callExecBad, 23, QUANDARY_TAINT_ERROR, [return from getenv,call to execvp]
 codetoanalyze/cpp/quandary/execs.cpp, execs::callExecBad, 25, QUANDARY_TAINT_ERROR, [return from getenv,call to execv]
 codetoanalyze/cpp/quandary/execs.cpp, execs::callExecBad, 27, QUANDARY_TAINT_ERROR, [return from getenv,call to execvp]
+codetoanalyze/cpp/quandary/execs.cpp, execs::callExecBad, 29, QUANDARY_TAINT_ERROR, [return from getenv,call to execve]
+codetoanalyze/cpp/quandary/execs.cpp, execs::callExecBad, 31, QUANDARY_TAINT_ERROR, [return from getenv,call to execve]
+codetoanalyze/cpp/quandary/execs.cpp, execs::callExecBad, 33, QUANDARY_TAINT_ERROR, [return from getenv,call to system]
 codetoanalyze/cpp/quandary/files.cpp, files::read_file_call_exec_bad1, 5, QUANDARY_TAINT_ERROR, [return from std::basic_istream<char,std::char_traits<char>>_read,call to execle]
 codetoanalyze/cpp/quandary/files.cpp, files::read_file_call_exec_bad2, 5, QUANDARY_TAINT_ERROR, [return from std::basic_istream<char,std::char_traits<char>>_readsome,call to execle]
 codetoanalyze/cpp/quandary/files.cpp, files::read_file_call_exec_bad3, 5, QUANDARY_TAINT_ERROR, [return from std::basic_istream<char,std::char_traits<char>>_getline,call to execle]