C++: Taint propagation through dynamic_cast #2713
Conversation
| @@ -96,6 +96,10 @@ private predicate operandIsPropagated(Operand operand, IntValue bitOffset) { | |||
| bitOffset = Ints::mul(convert.getDerivation().getByteOffset(), 8) | |||
| ) | |||
| or | |||
| // Conversion using dynamic_cast results in an unknown offset | |||
| instr instanceof CheckedConvertOrNullInstruction and | |||
| bitOffset = Ints::unknown() | |||
There was a problem hiding this comment.
Must the offset be unknown in order for the alias analysis to work? I think of dynamic_cast<D*>(b) as meaning roughly (*b instanceof D) ? static_cast<D*>(b) : nullptr, but maybe that's an oversimplification? If the type check doesn't pass, then the returned pointer doesn't point to any object, but that's also sort of true for a static_cast.
There was a problem hiding this comment.
The "sidecast" case in https://en.cppreference.com/w/cpp/language/dynamic_cast means that the offset is at least sometimes unknown. Even for the downcast case, there isn't an unambiguous offset for a conversion from Y to Base in https://godbolt.org/z/ebWA7x
There was a problem hiding this comment.
There's also the special case of dynamic_cast<void*> which casts to the most specific polymorphic class: https://godbolt.org/z/AZJpxS
There was a problem hiding this comment.
Thanks for the explanations. Inheritance is scary!
Adds taint propagation through
dynamic_castexpressions