Skip to content

Commit c2123f2

Browse files
geoffw0geoffw0
committed
Swift: More detailed models for pointers.
1 parent ba6d348 commit c2123f2

File tree

4 files changed

+145
-22
lines changed

4 files changed

+145
-22
lines changed

‎swift/ql/lib/codeql/swift/frameworks/StandardLibrary/PointerTypes.qll

Lines changed: 124 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,9 @@
44
*/
55

66
import swift
7+
private import codeql.swift.dataflow.DataFlow
78
private import codeql.swift.dataflow.ExternalFlow
9+
private import codeql.swift.dataflow.FlowSteps
810

911
/**
1012
* A Swift unsafe typed pointer type such as `UnsafePointer`,
@@ -69,41 +71,162 @@ private class PointerSummaries extends SummaryModelCsv {
6971
";UnsafePointer;true;withMemoryRebound(to:capacity:_:);;;Argument[-1].CollectionElement;Argument[2].Parameter[0].CollectionElement;taint",
7072
";UnsafePointer;true;withMemoryRebound(to:capacity:_:);;;Argument[2].ReturnValue;ReturnValue;value",
7173
// ---
72-
";UnsafeMutablePointer;true;init(mutating:);;;Argument[0];ReturnValue;taint",
74+
";UnsafeMutablePointer;true;init(_:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
75+
";UnsafeMutablePointer;true;init(_:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.OptionalSome.CollectionElement;value",
76+
";UnsafeMutablePointer;true;init(mutating:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
77+
";UnsafeMutablePointer;true;init(mutating:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.OptionalSome.CollectionElement;value",
78+
";UnsafeMutablePointer;true;assign(from:count:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
79+
";UnsafeMutablePointer;true;assign(repeating:count:);;;Argument[0];Argument[-1].CollectionElement;value",
80+
";UnsafeMutablePointer;true;initialize(from:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
81+
";UnsafeMutablePointer;true;initialize(from:count:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
82+
";UnsafeMutablePointer;true;initialize(repeating:count:);;;Argument[0];Argument[-1].CollectionElement;value",
83+
";UnsafeMutablePointer;true;initialize(to:);;;Argument[0];Argument[-1].CollectionElement;value",
84+
";UnsafeMutablePointer;true;initialize(to:count:);;;Argument[0];Argument[-1].CollectionElement;value",
85+
";UnsafeMutablePointer;true;move();;;Argument[-1].CollectionElement;ReturnValue;value",
86+
";UnsafeMutablePointer;true;moveAssign(from:count:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
87+
";UnsafeMutablePointer;true;moveInitialize(from:count:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
88+
";UnsafeMutablePointer;true;moveUpdate(from:count:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
89+
";UnsafeMutablePointer;true;update(from:count:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
90+
";UnsafeMutablePointer;true;update(repeating:count:);;;Argument[0];Argument[-1].CollectionElement;value",
7391
";UnsafeMutablePointer;true;withMemoryRebound(to:capacity:_:);;;Argument[-1].CollectionElement;Argument[2].Parameter[0].CollectionElement;taint",
7492
";UnsafeMutablePointer;true;withMemoryRebound(to:capacity:_:);;;Argument[2].Parameter[0].CollectionElement;Argument[-1].CollectionElement;taint",
7593
";UnsafeMutablePointer;true;withMemoryRebound(to:capacity:_:);;;Argument[2].ReturnValue;ReturnValue;value",
7694
// ---
95+
";UnsafeBufferPointer;true;init(_:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
96+
";UnsafeBufferPointer;true;init(rebasing:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
97+
";UnsafeBufferPointer;true;init(start:count:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.CollectionElement;taint",
7798
";UnsafeBufferPointer;true;withMemoryRebound(to:_:);;;Argument[-1].CollectionElement;Argument[1].Parameter[0].CollectionElement;taint",
7899
";UnsafeBufferPointer;true;withMemoryRebound(to:_:);;;Argument[1].ReturnValue;ReturnValue;value",
79100
// ---
101+
";UnsafeMutableBufferPointer;true;init(mutating:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
102+
";UnsafeMutableBufferPointer;true;init(rebasing:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
103+
";UnsafeMutableBufferPointer;true;init(start:count:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.CollectionElement;taint",
104+
";UnsafeMutableBufferPointer;true;assign(repeating:);;;Argument[0];Argument[-1].CollectionElement;value",
105+
";UnsafeMutableBufferPointer;true;initialize(from:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;taint",
106+
";UnsafeMutableBufferPointer;true;initialize(from:);;;Argument[0].CollectionElement;ReturnValue.TupleElement[0].CollectionElement;taint",
107+
";UnsafeMutableBufferPointer;true;initialize(fromContentsOf:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
108+
";UnsafeMutableBufferPointer;true;initialize(repeating:);;;Argument[0];Argument[-1].CollectionElement;value",
109+
";UnsafeMutableBufferPointer;true;initializeElement(at:to:);;;Argument[1];Argument[-1].CollectionElement;value",
110+
";UnsafeMutableBufferPointer;true;moveElement(from:);;;Argument[-1].CollectionElement;ReturnValue;value",
111+
";UnsafeMutableBufferPointer;true;moveInitialize(fromContentsOf:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
112+
";UnsafeMutableBufferPointer;true;moveUpdate(fromContentsOf:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
113+
";UnsafeMutableBufferPointer;true;update(from:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;taint",
114+
";UnsafeMutableBufferPointer;true;update(from:);;;Argument[0].CollectionElement;ReturnValue.TupleElement[0].CollectionElement;taint",
115+
";UnsafeMutableBufferPointer;true;update(fromContentsOf:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
80116
";UnsafeMutableBufferPointer;true;update(repeating:);;;Argument[0];Argument[-1].CollectionElement;value",
81117
";UnsafeMutableBufferPointer;true;withMemoryRebound(to:_:);;;Argument[-1].CollectionElement;Argument[1].Parameter[0].CollectionElement;taint",
82118
";UnsafeMutableBufferPointer;true;withMemoryRebound(to:_:);;;Argument[1].Parameter[0].CollectionElement;Argument[-1].CollectionElement;taint",
83119
";UnsafeMutableBufferPointer;true;withMemoryRebound(to:_:);;;Argument[1].ReturnValue;ReturnValue;value",
84120
// ---
121+
";UnsafeRawPointer;true;init(_:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
122+
";UnsafeRawPointer;true;init(_:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.OptionalSome.CollectionElement;value",
123+
";UnsafeRawPointer;true;alignedDown(for:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
124+
";UnsafeRawPointer;true;alignedDown(toMultipleOf:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
125+
";UnsafeRawPointer;true;alignedUp(for:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
126+
";UnsafeRawPointer;true;alignedUp(toMultipleOf:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
127+
";UnsafeRawPointer;true;load(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
128+
";UnsafeRawPointer;true;loadUnaligned(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
85129
";UnsafeRawPointer;true;withMemoryRebound(to:capacity:_:);;;Argument[-1].CollectionElement;Argument[2].Parameter[0].CollectionElement;taint",
86130
";UnsafeRawPointer;true;withMemoryRebound(to:capacity:_:);;;Argument[2].ReturnValue;ReturnValue;value",
87131
";UnsafeRawPointer;true;assumingMemoryBound(to:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
88132
";UnsafeRawPointer;true;bindMemory(to:capacity:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
89133
// ---
134+
";UnsafeMutableRawPointer;true;init(_:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
135+
";UnsafeMutableRawPointer;true;init(_:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.OptionalSome.CollectionElement;value",
136+
";UnsafeMutableRawPointer;true;init(mutating:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
137+
";UnsafeMutableRawPointer;true;init(mutating:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.OptionalSome.CollectionElement;value",
138+
";UnsafeMutableRawPointer;true;alignedDown(for:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
139+
";UnsafeMutableRawPointer;true;alignedDown(toMultipleOf:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
140+
";UnsafeMutableRawPointer;true;alignedUp(for:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
141+
";UnsafeMutableRawPointer;true;alignedUp(toMultipleOf:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
142+
";UnsafeMutableRawPointer;true;copyBytes(from:count:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;taint",
143+
";UnsafeMutableRawPointer;true;copyMemory(from:count:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;taint",
144+
";UnsafeMutableRawPointer;true;initializeMemory(as:at:count:to:);;;Argument[3];Argument[-1].CollectionElement;taint",
145+
";UnsafeMutableRawPointer;true;initializeMemory(as:at:count:to:);;;Argument[3];ReturnValue.CollectionElement;taint",
146+
";UnsafeMutableRawPointer;true;initializeMemory(as:from:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
147+
";UnsafeMutableRawPointer;true;initializeMemory(as:from:);;;Argument[1].CollectionElement;ReturnValue.CollectionElement;taint",
148+
";UnsafeMutableRawPointer;true;initializeMemory(as:from:count:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
149+
";UnsafeMutableRawPointer;true;initializeMemory(as:from:count:);;;Argument[1].CollectionElement;ReturnValue.CollectionElement;taint",
150+
";UnsafeMutableRawPointer;true;initializeMemory(as:repeating:count:);;;Argument[1];Argument[-1].CollectionElement;taint",
151+
";UnsafeMutableRawPointer;true;initializeMemory(as:repeating:count:);;;Argument[1];ReturnValue.CollectionElement;taint",
152+
";UnsafeMutableRawPointer;true;initializeMemory(as:to:);;;Argument[1];Argument[-1].CollectionElement;taint",
153+
";UnsafeMutableRawPointer;true;initializeMemory(as:to:);;;Argument[1];ReturnValue.CollectionElement;taint",
154+
";UnsafeMutableRawPointer;true;load(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
155+
";UnsafeMutableRawPointer;true;loadUnaligned(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
156+
";UnsafeMutableRawPointer;true;moveInitializeMemory(as:from:count:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
157+
";UnsafeMutableRawPointer;true;moveInitializeMemory(as:from:count:);;;Argument[1].CollectionElement;ReturnValue.CollectionElement;taint",
158+
";UnsafeMutableRawPointer;true;storeBytes(of:toByteOffset:as:);;;Argument[0];Argument[-1].CollectionElement;taint",
90159
";UnsafeMutableRawPointer;true;withMemoryRebound(to:capacity:_:);;;Argument[-1].CollectionElement;Argument[2].Parameter[0].CollectionElement;taint",
91160
";UnsafeMutableRawPointer;true;withMemoryRebound(to:capacity:_:);;;Argument[2].Parameter[0].CollectionElement;Argument[-1].CollectionElement;taint",
92161
";UnsafeMutableRawPointer;true;withMemoryRebound(to:capacity:_:);;;Argument[2].ReturnValue;ReturnValue;value",
93162
";UnsafeMutableRawPointer;true;assumingMemoryBound(to:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
94163
";UnsafeMutableRawPointer;true;bindMemory(to:capacity:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
95164
// ---
165+
";UnsafeRawBufferPointer;true;init(_:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
166+
";UnsafeRawBufferPointer;true;init(rebasing:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
167+
";UnsafeRawBufferPointer;true;init(start:count:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.CollectionElement;taint",
168+
";UnsafeRawBufferPointer;true;load(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
169+
";UnsafeRawBufferPointer;true;loadUnaligned(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
96170
";UnsafeRawBufferPointer;true;withMemoryRebound(to:_:);;;Argument[-1].CollectionElement;Argument[1].Parameter[0].CollectionElement;taint",
97171
";UnsafeRawBufferPointer;true;withMemoryRebound(to:_:);;;Argument[1].ReturnValue;ReturnValue;value",
98172
";UnsafeRawBufferPointer;true;assumingMemoryBound(to:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
99173
";UnsafeRawBufferPointer;true;bindMemory(to:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
100174
// ---
175+
";UnsafeMutableRawBufferPointer;true;init(_:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
176+
";UnsafeMutableRawBufferPointer;true;init(mutating:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
177+
";UnsafeMutableRawBufferPointer;true;init(rebasing:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
178+
";UnsafeMutableRawBufferPointer;true;init(start:count:);;;Argument[0].OptionalSome.CollectionElement;ReturnValue.CollectionElement;taint",
179+
";UnsafeMutableRawBufferPointer;true;copyBytes(from:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
180+
";UnsafeMutableRawBufferPointer;true;copyMemory(from:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
181+
";UnsafeMutableRawBufferPointer;true;initializeMemory(as:from:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
182+
";UnsafeMutableRawBufferPointer;true;initializeMemory(as:from:);;;Argument[1].CollectionElement;ReturnValue.TupleElement[0,1].CollectionElement;taint",
183+
";UnsafeMutableRawBufferPointer;true;initializeMemory(as:fromContentsOf:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
184+
";UnsafeMutableRawBufferPointer;true;initializeMemory(as:fromContentsOf:);;;Argument[1].CollectionElement;ReturnValue.TupleElement[0,1].CollectionElement;taint",
185+
";UnsafeMutableRawBufferPointer;true;initializeMemory(as:repeating:);;;Argument[1];Argument[-1].CollectionElement;taint",
186+
";UnsafeMutableRawBufferPointer;true;initializeMemory(as:repeating:);;;Argument[1];ReturnValue.TupleElement[0,1].CollectionElement;taint",
187+
";UnsafeMutableRawBufferPointer;true;load(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
188+
";UnsafeMutableRawBufferPointer;true;loadUnaligned(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
189+
";UnsafeMutableRawBufferPointer;true;moveInitializeMemory(as:fromContentsOf:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
190+
";UnsafeMutableRawBufferPointer;true;moveInitializeMemory(as:fromContentsOf:);;;Argument[1].CollectionElement;ReturnValue.CollectionElement;taint",
191+
";UnsafeMutableRawBufferPointer;true;storeBytes(of:toByteOffset:as:);;;Argument[0];Argument[-1].CollectionElement;taint",
101192
";UnsafeMutableRawBufferPointer;true;withMemoryRebound(to:_:);;;Argument[-1].CollectionElement;Argument[1].Parameter[0].CollectionElement;taint",
102193
";UnsafeMutableRawBufferPointer;true;withMemoryRebound(to:_:);;;Argument[1].Parameter[0].CollectionElement;Argument[-1].CollectionElement;taint",
103194
";UnsafeMutableRawBufferPointer;true;withMemoryRebound(to:_:);;;Argument[1].ReturnValue;ReturnValue;value",
104195
";UnsafeMutableRawBufferPointer;true;assumingMemoryBound(to:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
105196
";UnsafeMutableRawBufferPointer;true;bindMemory(to:);;;Argument[-1].CollectionElement;ReturnValue.CollectionElement;taint",
106197
// ---
198+
";Slice;true;init(base:bounds:);;;Argument[0].CollectionElement;ReturnValue.CollectionElement;value",
199+
";Slice;true;copyBytes(from:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;taint",
200+
";Slice;true;initialize(from:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;taint",
201+
";Slice;true;initialize(from:);;;Argument[0].CollectionElement;ReturnValue.TupleElement[0,1].CollectionElement;taint",
202+
";Slice;true;initialize(fromContentsOf:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;taint",
203+
";Slice;true;initialize(repeating:);;;Argument[0];Argument[-1].CollectionElement;value",
204+
";Slice;true;initializeElement(at:to:);;;Argument[1];Argument[-1].CollectionElement;value",
205+
";Slice;true;initializeMemory(as:from:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
206+
";Slice;true;initializeMemory(as:from:);;;Argument[1].CollectionElement;ReturnValue.TupleElement[0,1].CollectionElement;taint",
207+
";Slice;true;initializeMemory(as:fromContentsOf:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
208+
";Slice;true;initializeMemory(as:fromContentsOf:);;;Argument[1].CollectionElement;ReturnValue.CollectionElement;taint",
209+
";Slice;true;initializeMemory(as:repeating:);;;Argument[1];Argument[-1].CollectionElement;taint",
210+
";Slice;true;initializeMemory(as:repeating:);;;Argument[1];ReturnValue.CollectionElement;taint",
211+
";Slice;true;insert(_:at:);;;Argument[0];Argument[-1].CollectionElement;value",
212+
";Slice;true;insert(contentsOf:at:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
213+
";Slice;true;load(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
214+
";Slice;true;loadUnaligned(fromByteOffset:as:);;;Argument[-1].CollectionElement;ReturnValue;taint",
215+
";Slice;true;moveElement(from:);;;Argument[-1].CollectionElement;ReturnValue;value",
216+
";Slice;true;moveInitialize(fromContentsOf:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
217+
";Slice;true;moveInitializeMemory(as:fromContentsOf:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;taint",
218+
";Slice;true;moveInitializeMemory(as:fromContentsOf:);;;Argument[1].CollectionElement;ReturnValue.CollectionElement;taint",
219+
";Slice;true;moveUpdate(fromContentsOf:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
220+
";Slice;true;remove(at:);;;Argument[-1].CollectionElement;ReturnValue;value",
221+
";Slice;true;replaceSubrange(_:with:);;;Argument[1].CollectionElement;Argument[-1].CollectionElement;value",
222+
";Slice;true;storeBytes(of:toByteOffset:as:);;;Argument[0];Argument[-1].CollectionElement;taint",
223+
";Slice;true;update(from:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
224+
";Slice;true;update(from:);;;Argument[0].CollectionElement;ReturnValue.TupleElement[0].CollectionElement;taint",
225+
";Slice;true;update(fromContentsOf:);;;Argument[0].CollectionElement;Argument[-1].CollectionElement;value",
226+
";Slice;true;update(repeating:);;;Argument[0];Argument[-1].CollectionElement;value",
227+
";Slice;true;withContiguousMutableStorageIfAvailable(to:_:);;;Argument[-1].CollectionElement;Argument[0].Parameter[0].CollectionElement;taint",
228+
";Slice;true;withContiguousMutableStorageIfAvailable(to:_:);;;Argument[0].Parameter[0].CollectionElement;Argument[-1].CollectionElement;taint",
229+
";Slice;true;withContiguousMutableStorageIfAvailable(to:_:);;;Argument[0].ReturnValue;ReturnValue;value",
107230
";Slice;true;withMemoryRebound(to:_:);;;Argument[-1].CollectionElement;Argument[1].Parameter[0].CollectionElement;taint",
108231
";Slice;true;withMemoryRebound(to:_:);;;Argument[1].Parameter[0].CollectionElement;Argument[-1].CollectionElement;taint",
109232
";Slice;true;withMemoryRebound(to:_:);;;Argument[1].ReturnValue;ReturnValue;value",

0 commit comments

Comments
 (0)