@@ -151,6 +151,22 @@ private predicate instructionTaintStep(Instruction i1, Instruction i2) {
151151 // from `a`.
152152 i2 .( PointerAddInstruction ) .getLeft ( ) = i1
153153 or
154+ // Until we have from through indirections across calls, we'll take flow out
155+ // of the parameter and into its indirection.
156+ exists ( IRFunction f , Parameter parameter |
157+ i1 = getInitializeParameter ( f , parameter ) and
158+ i2 = getInitializeIndirection ( f , parameter )
159+ )
160+ or
161+ // Until we have flow through indirections across calls, we'll take flow out
162+ // of the indirection and into the argument.
163+ // When we get proper flow through indirections across calls, this code can be
164+ // moved to `adjusedSink` or possibly into the `DataFlow::ExprNode` class.
165+ exists ( ReadSideEffectInstruction read |
166+ read .getAnOperand ( ) .( SideEffectOperand ) .getAnyDef ( ) = i1 and
167+ read .getArgumentDef ( ) = i2
168+ )
169+ or
154170 // Flow from argument to return value
155171 i2 =
156172 any ( CallInstruction call |
@@ -176,6 +192,18 @@ private predicate instructionTaintStep(Instruction i1, Instruction i2) {
176192 )
177193}
178194
195+ pragma [ noinline]
196+ private InitializeIndirectionInstruction getInitializeIndirection ( IRFunction f , Parameter p ) {
197+ result .getParameter ( ) = p and
198+ result .getEnclosingIRFunction ( ) = f
199+ }
200+
201+ pragma [ noinline]
202+ private InitializeParameterInstruction getInitializeParameter ( IRFunction f , Parameter p ) {
203+ result .getParameter ( ) = p and
204+ result .getEnclosingIRFunction ( ) = f
205+ }
206+
179207/**
180208 * Get an instruction that goes into argument `argumentIndex` of `call`. This
181209 * can be either directly or through one pointer indirection.
@@ -273,23 +301,6 @@ private Element adjustedSink(DataFlow::Node sink) {
273301 // For compatibility, send flow into a `NotExpr` even if it's part of a
274302 // short-circuiting condition and thus might get skipped.
275303 result .( NotExpr ) .getOperand ( ) = sink .asExpr ( )
276- or
277- // For compatibility, send flow from argument read side effects to their
278- // corresponding argument expression
279- exists ( IndirectReadSideEffectInstruction read |
280- read .getAnOperand ( ) .( SideEffectOperand ) .getAnyDef ( ) = sink .asInstruction ( ) and
281- read .getArgumentDef ( ) .getUnconvertedResultExpression ( ) = result
282- )
283- or
284- exists ( BufferReadSideEffectInstruction read |
285- read .getAnOperand ( ) .( SideEffectOperand ) .getAnyDef ( ) = sink .asInstruction ( ) and
286- read .getArgumentDef ( ) .getUnconvertedResultExpression ( ) = result
287- )
288- or
289- exists ( SizedBufferReadSideEffectInstruction read |
290- read .getAnOperand ( ) .( SideEffectOperand ) .getAnyDef ( ) = sink .asInstruction ( ) and
291- read .getArgumentDef ( ) .getUnconvertedResultExpression ( ) = result
292- )
293304}
294305
295306predicate tainted ( Expr source , Element tainted ) {
0 commit comments