Summary: This was never quite finished and inferbo has a new way to do sort of the same thing. Reviewed By: skcho, ngorogiannis Differential Revision: D20362619 fbshipit-source-id: 7c7935d47master
Jules Villard
5 years ago
committed by
Facebook GitHub Bot
parent
1faf00e58e
commit
e5b50d7d46
@ -1,127 +0,0 @@
|
||||
(*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*)
|
||||
|
||||
open! IStd
|
||||
|
||||
let update_issues all_issues =
|
||||
let quandary_access_issues = [IssueType.untrusted_buffer_access] in
|
||||
let quandary_alloc_issues =
|
||||
IssueType.[untrusted_heap_allocation; untrusted_variable_length_array]
|
||||
in
|
||||
let inferbo_access_issues =
|
||||
IssueType.
|
||||
[ buffer_overrun_l1
|
||||
; buffer_overrun_l2
|
||||
; buffer_overrun_l3
|
||||
; buffer_overrun_l4
|
||||
; buffer_overrun_l5
|
||||
; buffer_overrun_s2
|
||||
; buffer_overrun_u5 ]
|
||||
in
|
||||
let inferbo_alloc_issues =
|
||||
IssueType.
|
||||
[ inferbo_alloc_is_big
|
||||
; inferbo_alloc_is_zero
|
||||
; inferbo_alloc_is_negative
|
||||
; inferbo_alloc_may_be_big
|
||||
; inferbo_alloc_may_be_negative ]
|
||||
in
|
||||
let is_quandary_access_issue issue =
|
||||
List.mem quandary_access_issues issue.Issue.err_key.err_name ~equal:IssueType.equal
|
||||
in
|
||||
let is_quandary_alloc_issue issue =
|
||||
List.mem quandary_alloc_issues issue.Issue.err_key.err_name ~equal:IssueType.equal
|
||||
in
|
||||
let is_relevant_quandary_issue issue =
|
||||
is_quandary_access_issue issue || is_quandary_alloc_issue issue
|
||||
in
|
||||
let is_inferbo_access_issue issue =
|
||||
List.mem inferbo_access_issues issue.Issue.err_key.err_name ~equal:IssueType.equal
|
||||
in
|
||||
let is_inferbo_alloc_issue issue =
|
||||
List.mem inferbo_alloc_issues issue.Issue.err_key.err_name ~equal:IssueType.equal
|
||||
in
|
||||
let is_relevant_inferbo_issue issue =
|
||||
is_inferbo_access_issue issue || is_inferbo_alloc_issue issue
|
||||
in
|
||||
let quandary_issues, inferBO_issues =
|
||||
List.fold all_issues ~init:([], []) ~f:(fun (q_issues, iBO_issues) issue ->
|
||||
if is_relevant_quandary_issue issue then (issue :: q_issues, iBO_issues)
|
||||
else if is_relevant_inferbo_issue issue then (q_issues, issue :: iBO_issues)
|
||||
else (q_issues, iBO_issues) )
|
||||
in
|
||||
let matching_issues quandary_issue inferbo_issue =
|
||||
let trace_end_match () =
|
||||
let quandary_trace_end = List.last quandary_issue.Issue.err_data.loc_trace in
|
||||
let inferbo_trace_end = List.last inferbo_issue.Issue.err_data.loc_trace in
|
||||
match (quandary_trace_end, inferbo_trace_end) with
|
||||
| Some quandary_trace_elem, Some inferbo_trace_elem ->
|
||||
let q_loc = quandary_trace_elem.lt_loc in
|
||||
let i_loc = inferbo_trace_elem.lt_loc in
|
||||
SourceFile.equal q_loc.file i_loc.file && Int.equal q_loc.line i_loc.line
|
||||
| _ ->
|
||||
false
|
||||
in
|
||||
SourceFile.equal quandary_issue.Issue.proc_location.file inferbo_issue.Issue.proc_location.file
|
||||
&& Int.equal quandary_issue.Issue.proc_location.line inferbo_issue.Issue.proc_location.line
|
||||
&& trace_end_match ()
|
||||
&& ( (is_quandary_alloc_issue quandary_issue && is_inferbo_alloc_issue inferbo_issue)
|
||||
|| (is_quandary_access_issue quandary_issue && is_inferbo_access_issue inferbo_issue) )
|
||||
in
|
||||
let paired_issues =
|
||||
(* Can be computed more efficiently (in n*log(n)) by using a Map mapping
|
||||
file name + line number to quandary_issues to match with inferbo_issues *)
|
||||
List.concat_map quandary_issues ~f:(fun quandary_issue ->
|
||||
List.filter_map inferBO_issues ~f:(fun inferbo_issue ->
|
||||
if matching_issues quandary_issue inferbo_issue then Some (quandary_issue, inferbo_issue)
|
||||
else None ) )
|
||||
in
|
||||
let merge_issues (issue1, issue2) =
|
||||
{ Issue.proc_name= issue1.Issue.proc_name
|
||||
; proc_location= {issue1.Issue.proc_location with col= -1}
|
||||
; err_key=
|
||||
Errlog.merge_err_key issue1.Issue.err_key issue2.Issue.err_key
|
||||
~merge_issues:(fun issue1 _ ->
|
||||
if IssueType.equal issue1 IssueType.untrusted_buffer_access then
|
||||
IssueType.tainted_buffer_access
|
||||
else IssueType.tainted_memory_allocation )
|
||||
~merge_descriptions:(fun descs1 descs2 ->
|
||||
String.concat
|
||||
( "QuandaryBO error. Quandary error(s): \""
|
||||
:: (descs1 @ ("\". InferBO error(s):\"" :: (descs2 @ ["\"."]))) ) )
|
||||
; err_data= Errlog.merge_err_data issue1.Issue.err_data issue2.Issue.err_data }
|
||||
in
|
||||
(* Can merge List.map, List.concat_map and List.filter_map into a single fold. *)
|
||||
let quandaryBO_issues = List.map ~f:merge_issues paired_issues in
|
||||
let quandary_issues =
|
||||
IssueType.
|
||||
[ quandary_taint_error
|
||||
; shell_injection
|
||||
; shell_injection_risk
|
||||
; sql_injection
|
||||
; sql_injection_risk
|
||||
; untrusted_buffer_access
|
||||
; untrusted_file_risk
|
||||
; untrusted_heap_allocation
|
||||
; untrusted_url_risk
|
||||
; untrusted_variable_length_array
|
||||
; user_controlled_sql_risk ]
|
||||
in
|
||||
let inferbo_issues =
|
||||
inferbo_alloc_issues @ inferbo_access_issues @ [IssueType.unreachable_code_after]
|
||||
in
|
||||
let filtered_issues = Config.quandaryBO_filtered_issues in
|
||||
let all_issues_filtered =
|
||||
List.filter
|
||||
~f:(fun issue ->
|
||||
let issue_in ls = List.mem ls issue.Issue.err_key.err_name ~equal:IssueType.equal in
|
||||
(Config.is_checker_enabled Quandary || not (issue_in quandary_issues))
|
||||
&& (Config.is_checker_enabled BufferOverrun || not (issue_in inferbo_issues))
|
||||
&& not (issue_in filtered_issues) )
|
||||
all_issues
|
||||
in
|
||||
List.rev_append all_issues_filtered quandaryBO_issues
|
||||
@ -1,10 +0,0 @@
|
||||
(*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*)
|
||||
|
||||
open! IStd
|
||||
|
||||
val update_issues : Issue.t list -> Issue.t list
|
||||
@ -1,8 +0,0 @@
|
||||
{
|
||||
"quandary-sources": [
|
||||
{
|
||||
"procedure": "__infer_taint_source",
|
||||
"kind": "Other"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,57 +0,0 @@
|
||||
# Copyright (c) Facebook, Inc. and its affiliates.
|
||||
#
|
||||
# This source code is licensed under the MIT license found in the
|
||||
# LICENSE file in the root directory of this source tree.
|
||||
TESTS_DIR = ../../..
|
||||
|
||||
OPTIONS_1 = \
|
||||
--quandaryBO-only --passthroughs --debug-exceptions --filtering \
|
||||
--project-root $(TESTS_DIR) \
|
||||
|
||||
OPTIONS_2 = \
|
||||
--quandaryBO-only --quandary --enable-issue-type UNTRUSTED_BUFFER_ACCESS \
|
||||
--passthroughs --debug-exceptions --filtering \
|
||||
--project-root $(TESTS_DIR) \
|
||||
|
||||
OPTIONS_3 = \
|
||||
--quandaryBO-only --bufferoverrun --enable-issue-type BUFFER_OVERRUN_U5 \
|
||||
--passthroughs --debug-exceptions --filtering \
|
||||
--project-root $(TESTS_DIR) \
|
||||
|
||||
OPTIONS_4 = \
|
||||
--quandaryBO-only --bufferoverrun --debug-exceptions --no-filtering \
|
||||
--project-root $(TESTS_DIR) \
|
||||
|
||||
test: test1 test2 test3 test4
|
||||
|
||||
test1:
|
||||
$(MAKE) -f multitest.make test TEST_SUFFIX=-t1 TEST_RESULT_SUFFIX=-t1 INFER_OPTIONS="$(OPTIONS_1)"
|
||||
|
||||
test2:
|
||||
$(MAKE) -f multitest.make test TEST_SUFFIX=-t2 TEST_RESULT_SUFFIX=-t2 INFER_OPTIONS="$(OPTIONS_2)"
|
||||
|
||||
test3:
|
||||
$(MAKE) -f multitest.make test TEST_SUFFIX=-t3 TEST_RESULT_SUFFIX=-t3 INFER_OPTIONS="$(OPTIONS_3)"
|
||||
|
||||
test4:
|
||||
$(MAKE) -f multitest.make test TEST_SUFFIX=-t4 TEST_RESULT_SUFFIX=-t4 INFER_OPTIONS="$(OPTIONS_4)"
|
||||
|
||||
replace: replace1 replace2 replace3 replace4
|
||||
|
||||
replace1:
|
||||
$(MAKE) -f multitest.make replace TEST_SUFFIX=-t1 TEST_RESULT_SUFFIX=-t1 INFER_OPTIONS="$(OPTIONS_1)"
|
||||
|
||||
replace2:
|
||||
$(MAKE) -f multitest.make replace TEST_SUFFIX=-t2 TEST_RESULT_SUFFIX=-t2 INFER_OPTIONS="$(OPTIONS_2)"
|
||||
|
||||
replace3:
|
||||
$(MAKE) -f multitest.make replace TEST_SUFFIX=-t3 TEST_RESULT_SUFFIX=-t3 INFER_OPTIONS="$(OPTIONS_3)"
|
||||
|
||||
replace4:
|
||||
$(MAKE) -f multitest.make replace TEST_SUFFIX=-t4 TEST_RESULT_SUFFIX=-t4 INFER_OPTIONS="$(OPTIONS_4)"
|
||||
|
||||
clean:
|
||||
$(MAKE) -f multitest.make clean TEST_SUFFIX=-t1
|
||||
$(MAKE) -f multitest.make clean TEST_SUFFIX=-t2
|
||||
$(MAKE) -f multitest.make clean TEST_SUFFIX=-t3
|
||||
$(MAKE) -f multitest.make clean TEST_SUFFIX=-t4
|
||||
@ -1,64 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*/
|
||||
|
||||
#include <cstdint>
|
||||
#include <memory>
|
||||
#include <stdexcept>
|
||||
|
||||
extern int __infer_taint_source();
|
||||
|
||||
namespace std {
|
||||
template <class T>
|
||||
unique_ptr<T> make_unique(size_t n) {
|
||||
typedef typename remove_extent<T>::type U;
|
||||
return unique_ptr<T>(new U[n]());
|
||||
}
|
||||
} // namespace std
|
||||
|
||||
namespace Codec_Bad {
|
||||
uint32_t getP_Bad(uint32_t w) {
|
||||
auto w4 = w * 4; // BUG: can overflow
|
||||
auto w4m1 = w4 - 1; // BUG: can underflow (if w = 0)
|
||||
auto w4m1o15 = w4m1 | 15; // ALWAYS OK
|
||||
auto w4m1o15p1 = w4m1o15 + 1; // BUG: can overflow
|
||||
return w4m1o15p1;
|
||||
}
|
||||
void foo_Bad_FN() {
|
||||
int w = __infer_taint_source();
|
||||
int h = __infer_taint_source();
|
||||
auto p =
|
||||
getP_Bad(w); // MISSED BUG: downcasting signed int64 -> unsigned int32
|
||||
auto s = h * p; // BUG: multiplication can overflow
|
||||
auto d = std::make_unique<uint8_t[]>(s); // MISSED BUG: casting signed int64
|
||||
// -> unsigned int64,
|
||||
}
|
||||
} // namespace Codec_Bad
|
||||
|
||||
namespace Codec_Bad2 {
|
||||
uint64_t getP_Bad(uint64_t w) {
|
||||
auto w4 = w * 4; // BUG: can overflow
|
||||
auto w4m1 = w4 - 1; // BUG: can underflow (if w = 0)
|
||||
auto w4m1o15 = w4m1 | 15; // ALWAYS OK
|
||||
auto w4m1o15p1 = w4m1o15 + 1; // BUG: can overflow
|
||||
return w4m1o15p1;
|
||||
}
|
||||
uint64_t checkedMultiply_Good(uint64_t a, uint64_t b) {
|
||||
__uint128_t mul = ((__uint128_t)a) * b; // OK: no overflow
|
||||
if ((mul >> 64) != 0) {
|
||||
throw std::runtime_error("Detected overflow in checked multiplcation");
|
||||
}
|
||||
auto result = (uint64_t)mul; // OK: within the bounds
|
||||
return result;
|
||||
}
|
||||
void foo_Bad_FN_FP() {
|
||||
int w = __infer_taint_source();
|
||||
int h = __infer_taint_source();
|
||||
auto p = getP_Bad(w); // MISSED BUG: casting signed int64 -> unsigned int64
|
||||
auto s = checkedMultiply_Good(h, p); // OK, FP
|
||||
auto d = std::make_unique<uint8_t[]>(s); // OK
|
||||
}
|
||||
} // namespace Codec_Bad2
|
||||
@ -1,5 +0,0 @@
|
||||
codetoanalyze/cpp/quandaryBO/codec.cpp, Codec_Bad2::foo_Bad_FN_FP, 3, INTEGER_OVERFLOW_L2, no_bucket, ERROR, [Unknown value from: __infer_taint_source,Assignment,Call,<LHS trace>,Parameter `w`,Assignment,Binary operation: ([0, +oo] - 1):unsigned64 by call to `Codec_Bad2::getP_Bad` ]
|
||||
codetoanalyze/cpp/quandaryBO/codec.cpp, Codec_Bad::foo_Bad_FN, 4, INTEGER_OVERFLOW_L2, no_bucket, ERROR, [Unknown value from: __infer_taint_source,Assignment,Call,<LHS trace>,Parameter `w`,Assignment,Binary operation: ([0, +oo] - 1):unsigned32 by call to `Codec_Bad::getP_Bad` ]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, basic_bad, 3, TAINTED_BUFFER_ACCESS, no_bucket, ERROR, [Return from __infer_taint_source,Call to __array_access with tainted index 0,-----------,<Offset trace>,Unknown value from: __infer_taint_source,Assignment,<Length trace>,Array declaration,Array access: Offset: [-oo, +oo] Size: 10]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, memory_alloc_bad2, 3, TAINTED_MEMORY_ALLOCATION, no_bucket, ERROR, [Return from __infer_taint_source,Call to __set_array_length with tainted index 1,-----------,Unknown value from: __infer_taint_source,Assignment,Allocation: Length: [-oo, 2147483647]]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, multi_level_bad, 2, TAINTED_BUFFER_ACCESS, no_bucket, ERROR, [Return from __infer_taint_source with tainted data return*,Return from multi_level_source_bad,Call to multi_level_sink_bad with tainted index 0,Call to __array_access with tainted index 0,-----------,Call,Unknown value from: __infer_taint_source,Assignment,Assignment,Call,<Offset trace>,Parameter `i`,<Length trace>,Array declaration,Array access: Offset: [1, +oo] Size: 10 by call to `multi_level_sink_bad` ]
|
||||
@ -1,10 +0,0 @@
|
||||
codetoanalyze/cpp/quandaryBO/codec.cpp, Codec_Bad2::foo_Bad_FN_FP, 3, INTEGER_OVERFLOW_L2, no_bucket, ERROR, [Unknown value from: __infer_taint_source,Assignment,Call,<LHS trace>,Parameter `w`,Assignment,Binary operation: ([0, +oo] - 1):unsigned64 by call to `Codec_Bad2::getP_Bad` ]
|
||||
codetoanalyze/cpp/quandaryBO/codec.cpp, Codec_Bad::foo_Bad_FN, 4, INTEGER_OVERFLOW_L2, no_bucket, ERROR, [Unknown value from: __infer_taint_source,Assignment,Call,<LHS trace>,Parameter `w`,Assignment,Binary operation: ([0, +oo] - 1):unsigned32 by call to `Codec_Bad::getP_Bad` ]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, basic_bad, 3, TAINTED_BUFFER_ACCESS, no_bucket, ERROR, [Return from __infer_taint_source,Call to __array_access with tainted index 0,-----------,<Offset trace>,Unknown value from: __infer_taint_source,Assignment,<Length trace>,Array declaration,Array access: Offset: [-oo, +oo] Size: 10]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, basic_bad, 3, UNTRUSTED_BUFFER_ACCESS, no_bucket, ERROR, [Return from __infer_taint_source,Call to __array_access with tainted index 0]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, memory_alloc_bad1_FN, 0, UNTRUSTED_VARIABLE_LENGTH_ARRAY, no_bucket, ERROR, [Return from __infer_taint_source,Call to __set_array_length with tainted index 1]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, memory_alloc_bad2, 3, TAINTED_MEMORY_ALLOCATION, no_bucket, ERROR, [Return from __infer_taint_source,Call to __set_array_length with tainted index 1,-----------,Unknown value from: __infer_taint_source,Assignment,Allocation: Length: [-oo, 2147483647]]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, memory_alloc_bad2, 3, UNTRUSTED_VARIABLE_LENGTH_ARRAY, no_bucket, ERROR, [Return from __infer_taint_source,Call to __set_array_length with tainted index 1]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, multi_level_bad, 2, TAINTED_BUFFER_ACCESS, no_bucket, ERROR, [Return from __infer_taint_source with tainted data return*,Return from multi_level_source_bad,Call to multi_level_sink_bad with tainted index 0,Call to __array_access with tainted index 0,-----------,Call,Unknown value from: __infer_taint_source,Assignment,Assignment,Call,<Offset trace>,Parameter `i`,<Length trace>,Array declaration,Array access: Offset: [1, +oo] Size: 10 by call to `multi_level_sink_bad` ]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, multi_level_bad, 2, UNTRUSTED_BUFFER_ACCESS, no_bucket, ERROR, [Return from __infer_taint_source with tainted data return*,Return from multi_level_source_bad,Call to multi_level_sink_bad with tainted index 0,Call to __array_access with tainted index 0]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, overlapping_issues_good, 1, UNTRUSTED_VARIABLE_LENGTH_ARRAY, no_bucket, ERROR, [Return from __infer_taint_source with tainted data @val$0.size*,Return from overlapping_issues_source_good,Call to overlapping_issues_sink_good with tainted index 0,Call to __set_array_length with tainted index 1]
|
||||
@ -1,8 +0,0 @@
|
||||
codetoanalyze/cpp/quandaryBO/codec.cpp, Codec_Bad2::foo_Bad_FN_FP, 3, INTEGER_OVERFLOW_L2, no_bucket, ERROR, [Unknown value from: __infer_taint_source,Assignment,Call,<LHS trace>,Parameter `w`,Assignment,Binary operation: ([0, +oo] - 1):unsigned64 by call to `Codec_Bad2::getP_Bad` ]
|
||||
codetoanalyze/cpp/quandaryBO/codec.cpp, Codec_Bad::foo_Bad_FN, 4, INTEGER_OVERFLOW_L2, no_bucket, ERROR, [Unknown value from: __infer_taint_source,Assignment,Call,<LHS trace>,Parameter `w`,Assignment,Binary operation: ([0, +oo] - 1):unsigned32 by call to `Codec_Bad::getP_Bad` ]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, basic_bad, 3, BUFFER_OVERRUN_U5, no_bucket, ERROR, [<Offset trace>,Unknown value from: __infer_taint_source,Assignment,<Length trace>,Array declaration,Array access: Offset: [-oo, +oo] Size: 10]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, basic_bad, 3, TAINTED_BUFFER_ACCESS, no_bucket, ERROR, [Return from __infer_taint_source,Call to __array_access with tainted index 0,-----------,<Offset trace>,Unknown value from: __infer_taint_source,Assignment,<Length trace>,Array declaration,Array access: Offset: [-oo, +oo] Size: 10]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, memory_alloc_bad2, 3, INFERBO_ALLOC_MAY_BE_BIG, no_bucket, ERROR, [Unknown value from: __infer_taint_source,Assignment,Allocation: Length: [-oo, 2147483647]]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, memory_alloc_bad2, 3, TAINTED_MEMORY_ALLOCATION, no_bucket, ERROR, [Return from __infer_taint_source,Call to __set_array_length with tainted index 1,-----------,Unknown value from: __infer_taint_source,Assignment,Allocation: Length: [-oo, 2147483647]]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, multi_level_bad, 2, BUFFER_OVERRUN_U5, no_bucket, ERROR, [Call,Unknown value from: __infer_taint_source,Assignment,Assignment,Call,<Offset trace>,Parameter `i`,<Length trace>,Array declaration,Array access: Offset: [1, +oo] Size: 10 by call to `multi_level_sink_bad` ]
|
||||
codetoanalyze/cpp/quandaryBO/tainted_index.cpp, multi_level_bad, 2, TAINTED_BUFFER_ACCESS, no_bucket, ERROR, [Return from __infer_taint_source with tainted data return*,Return from multi_level_source_bad,Call to multi_level_sink_bad with tainted index 0,Call to __array_access with tainted index 0,-----------,Call,Unknown value from: __infer_taint_source,Assignment,Assignment,Call,<Offset trace>,Parameter `i`,<Length trace>,Array declaration,Array access: Offset: [1, +oo] Size: 10 by call to `multi_level_sink_bad` ]
|
||||
@ -1,15 +0,0 @@
|
||||
# Copyright (c) Facebook, Inc. and its affiliates.
|
||||
#
|
||||
# This source code is licensed under the MIT license found in the
|
||||
# LICENSE file in the root directory of this source tree.
|
||||
|
||||
TESTS_DIR = ../../..
|
||||
|
||||
# see explanations in cpp/errors/Makefile for the custom isystem
|
||||
CLANG_OPTIONS = -x c++ -std=c++11 -nostdinc++ -isystem$(ROOT_DIR) -isystem$(CLANG_INCLUDES)/c++/v1/ -c
|
||||
|
||||
INFERPRINT_OPTIONS = --issues-tests
|
||||
|
||||
SOURCES = $(wildcard *.cpp)
|
||||
|
||||
include $(TESTS_DIR)/clang.make
|
||||
@ -1,73 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates.
|
||||
*
|
||||
* This source code is licensed under the MIT license found in the
|
||||
* LICENSE file in the root directory of this source tree.
|
||||
*/
|
||||
#include <stdlib.h>
|
||||
|
||||
extern int __infer_taint_source();
|
||||
extern void __infer_taint_sink(int i);
|
||||
|
||||
void basic_bad() {
|
||||
int arr[10];
|
||||
int source = __infer_taint_source();
|
||||
arr[source] = 2;
|
||||
}
|
||||
|
||||
int multi_level_source_bad() { return __infer_taint_source(); }
|
||||
|
||||
void multi_level_sink_bad(int i) {
|
||||
int arr[10];
|
||||
if (i > 0)
|
||||
arr[i] = 2;
|
||||
}
|
||||
|
||||
struct arg {
|
||||
int taint;
|
||||
int bo;
|
||||
};
|
||||
|
||||
arg multi_level_source_ok() {
|
||||
return {.taint = __infer_taint_source(), .bo = 12};
|
||||
}
|
||||
|
||||
void multi_level_sink_ok(int taint, int bo) {
|
||||
__infer_taint_sink(taint);
|
||||
int arr[10];
|
||||
arr[bo] = 0;
|
||||
}
|
||||
|
||||
void multi_level_bad() {
|
||||
int i = multi_level_source_bad();
|
||||
multi_level_sink_bad(i);
|
||||
}
|
||||
|
||||
void multi_level_good() { int i = multi_level_source_bad(); }
|
||||
|
||||
void memory_alloc_bad1_FN() { int arr[__infer_taint_source()]; }
|
||||
|
||||
void memory_alloc_bad2() {
|
||||
int s = __infer_taint_source();
|
||||
if (s <= 2147483647) {
|
||||
int arr[s];
|
||||
}
|
||||
}
|
||||
|
||||
struct st {
|
||||
int size;
|
||||
int ind;
|
||||
};
|
||||
|
||||
st overlapping_issues_source_good() {
|
||||
return {.size = __infer_taint_source(), .ind = 10};
|
||||
}
|
||||
|
||||
void overlapping_issues_sink_good(st info) {
|
||||
int arr[info.size];
|
||||
arr[info.ind] = 0;
|
||||
}
|
||||
|
||||
void overlapping_issues_good() {
|
||||
overlapping_issues_sink_good(overlapping_issues_source_good());
|
||||
}
|
||||
Loading…
Reference in new issue