Skip to content

Conversation

MathiasVP
Copy link
Contributor

@MathiasVP MathiasVP commented Apr 7, 2020

Previously we did not catch data flows such as:

int a = source();
int b = 0;
memcpy(&b, &a, sizeof(int));
sink(b); // tainted

because there's a ChiInstruction between the WriteSideEffect instruction and the load in sink(b). (Note that this was a still caught by taint flow).

This PR recovers these flows by inserting flow from write side effect instructions to the partial operand of Chi instructions, similar to how #3219 handles taint flows.

@MathiasVP MathiasVP added the C++ label Apr 7, 2020
@MathiasVP
Copy link
Contributor Author

MathiasVP commented Apr 7, 2020

I've started a CPP-differences run to make sure we don't add too much flow: https://jenkins.internal.semmle.com/job/Changes/job/CPP-Differences/1026/

As @jbj pointed out, we have flow to partial chi operands already in DefaultTaintTracking. So there's no new query results as there's no query that uses IR dataflow without using taintflow.

@MathiasVP MathiasVP mentioned this pull request Apr 7, 2020
@jbj jbj modified the milestone: 1.24 Apr 7, 2020
MathiasVP added a commit to MathiasVP/ql that referenced this pull request Apr 15, 2020
@MathiasVP
Copy link
Contributor Author

Closed as this PR was integrated into #3118.

@MathiasVP MathiasVP closed this Apr 17, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants