-
Notifications
You must be signed in to change notification settings - Fork 0
/
10_taint_tracking.ql
35 lines (28 loc) · 894 Bytes
/
10_taint_tracking.ql
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
/**
* @kind path-problem
*/
import cpp
import semmle.code.cpp.dataflow.TaintTracking
import DataFlow::PathGraph
class NetworkByteSwap extends Expr {
// TODO: copy from previous step
NetworkByteSwap(){
exists(MacroInvocation m | m.getMacroName().regexpMatch("ntoh.*") and
this=m.getExpr())
}
}
class Config extends TaintTracking::Configuration {
Config() { this = "NetworkToMemFuncLength" }
override predicate isSource(DataFlow::Node source) {
// TODO
source.asExpr() instanceof NetworkByteSwap
}
override predicate isSink(DataFlow::Node sink) {
// TODO
exists( FunctionCall fc, Function f |
fc.getTarget() = f and f.getName() = "memcpy" and sink.asExpr()=fc.getArgument(2) )
}
}
from Config cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink, source, sink, "Network byte swap flows to memcpy"