diff --git a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll index 31551858d1b2..f93506385318 100644 --- a/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll +++ b/cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll @@ -529,8 +529,21 @@ private string getTypeName(Type t, boolean needsSpace) { needsSpace = false and (if needsSpace0 = true then result = s + " *" else result = s + "*") or + // We don't need to check for `needsSpace0` here because the type of + // `x` in `int x[1024]` is formatted without a space between the bracket + // and the `int` by `Type.getName`. That is, calling `Type.getName` on + // the type of `x` gives `int[1024]` and not `int [1024]`. + needsSpace = false and + exists(ArrayType array | array = dt | + result = s + "[" + array.getArraySize() + "]" + or + not array.hasArraySize() and + result = s + "[]" + ) + or not dt instanceof ReferenceType and not dt instanceof PointerType and + not dt instanceof ArrayType and result = s and needsSpace = needsSpace0 ) diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/FlowSummaryNode.expected b/cpp/ql/test/library-tests/dataflow/models-as-data/FlowSummaryNode.expected index e9df16c95a96..756e9a7e22a5 100644 --- a/cpp/ql/test/library-tests/dataflow/models-as-data/FlowSummaryNode.expected +++ b/cpp/ql/test/library-tests/dataflow/models-as-data/FlowSummaryNode.expected @@ -76,3 +76,5 @@ | tests.cpp:437:5:437:36 | [summary] to write: ReturnValue in madCallReturnValueIgnoreFunction | ReturnNode | madCallReturnValueIgnoreFunction | madCallReturnValueIgnoreFunction | | tests.cpp:459:5:459:31 | [summary param] *0 in parameter_ref_to_return_ref | ParameterNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref | | tests.cpp:459:5:459:31 | [summary] to write: ReturnValue[*] in parameter_ref_to_return_ref | ReturnNode | parameter_ref_to_return_ref | parameter_ref_to_return_ref | +| tests.cpp:471:5:471:17 | [summary param] *0 in receive_array | ParameterNode | receive_array | receive_array | +| tests.cpp:471:5:471:17 | [summary] to write: ReturnValue in receive_array | ReturnNode | receive_array | receive_array | diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/SummaryCall.expected b/cpp/ql/test/library-tests/dataflow/models-as-data/SummaryCall.expected index 33e1c7f0975e..2dc6fbced908 100644 --- a/cpp/ql/test/library-tests/dataflow/models-as-data/SummaryCall.expected +++ b/cpp/ql/test/library-tests/dataflow/models-as-data/SummaryCall.expected @@ -30,6 +30,7 @@ summarizedCallables | tests.cpp:436:6:436:25 | madCallArg0WithValue | | tests.cpp:437:5:437:36 | madCallReturnValueIgnoreFunction | | tests.cpp:459:5:459:31 | parameter_ref_to_return_ref | +| tests.cpp:471:5:471:17 | receive_array | sourceCallables | tests.cpp:3:5:3:10 | source | | tests.cpp:4:6:4:14 | sourcePtr | @@ -230,3 +231,9 @@ sourceCallables | tests.cpp:463:6:463:6 | x | | tests.cpp:464:36:464:36 | s | | tests.cpp:465:6:465:6 | y | +| tests.cpp:469:7:469:9 | INT | +| tests.cpp:471:23:471:23 | a | +| tests.cpp:473:6:473:23 | test_receive_array | +| tests.cpp:474:6:474:6 | x | +| tests.cpp:475:6:475:10 | array | +| tests.cpp:476:6:476:6 | y | diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll b/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll index 319820437fff..e8d1393fc4a7 100644 --- a/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll +++ b/cpp/ql/test/library-tests/dataflow/models-as-data/testModels.qll @@ -98,7 +98,8 @@ private class TestSummaries extends SummaryModelCsv { ";;false;madCallArg0ReturnToReturnFirst;;;Argument[0].ReturnValue;ReturnValue.Field[first];value", ";;false;madCallArg0WithValue;;;Argument[1];Argument[0].Parameter[0];value", ";;false;madCallReturnValueIgnoreFunction;;;Argument[1];ReturnValue;value", - ";StructWithTypedefInParameter;true;parameter_ref_to_return_ref;(const T &);;Argument[*0];ReturnValue[*];value" + ";StructWithTypedefInParameter;true;parameter_ref_to_return_ref;(const T &);;Argument[*0];ReturnValue[*];value", + ";;false;receive_array;(int[20]);;Argument[*0];ReturnValue;taint" ] } } diff --git a/cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp b/cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp index cd750597905c..4c66b8ccbea9 100644 --- a/cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp +++ b/cpp/ql/test/library-tests/dataflow/models-as-data/tests.cpp @@ -464,4 +464,15 @@ void test_parameter_ref_to_return_ref() { StructWithTypedefInParameter s; int y = s.parameter_ref_to_return_ref(x); sink(y); // $ ir +} + +using INT = int; + +int receive_array(INT a[20]); // $ interpretElement + +void test_receive_array() { + int x = source(); + int array[10] = {x}; + int y = receive_array(array); + sink(y); // $ ir } \ No newline at end of file