-
Notifications
You must be signed in to change notification settings - Fork 1
/
10_taint_tracking.ql
29 lines (23 loc) · 843 Bytes
/
10_taint_tracking.ql
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
import cpp
import semmle.code.cpp.dataflow.TaintTracking
import DataFlow::PathGraph
class NetworkByteSwap extends Expr {
NetworkByteSwap () {
exists(MacroInvocation m |
m.getMacro().getName().regexpMatch("ntoh(l|s|ll)") and
this = m.getExpr()
)
}
}
class Config extends TaintTracking::Configuration {
Config() { this = "NetworkToMemFuncLength" }
override predicate isSource(DataFlow::Node source) {
source.asExpr() instanceof NetworkByteSwap
}
override predicate isSink(DataFlow::Node sink) {
exists(FunctionCall f | f.getTarget().getName() = "memcpy" and sink.asExpr() = f.getArgument(2))
}
}
from Config cfg, DataFlow::PathNode source, DataFlow::PathNode sink
where cfg.hasFlowPath(source, sink)
select sink, source, sink, "Network byte swap flows to memcpy"