@@ -115,4 +115,89 @@ void modify_copy_via_memcpy(char* p) { // $ ast-def=p
115115void test_modify_copy_via_memcpy (char * p) { // $ ast-def=p
116116 modify_copy_via_memcpy (p);
117117 sink (*p); // clean
118+ }
119+
120+ // These functions from any real database. We add a dataflow model of
121+ // them as part of dataflow library testing.
122+ // `r = strdup_ptr_001`(p) has flow from **p to **r
123+ // `r = strdup_ptr_011`(p) has flow from *p to *r, and **p to **r
124+ // `r = strdup_ptr_111`(p) has flow from p to r, *p to *r, **p to **r
125+ char ** strdup_ptr_001 (const char ** p);
126+ char ** strdup_ptr_011 (const char ** p);
127+ char ** strdup_ptr_111 (const char ** p);
128+
129+ void source_ref_ref (char ** toTaint) { // $ ast-def=toTaint ir-def=*toTaint ir-def=**toTaint
130+ // source -> **toTaint
131+ **toTaint = source (true );
132+ }
133+
134+ // This function copies the value of **p into a new location **p2 and then
135+ // taints **p. Thus, **p does not contain tainted data after returning from
136+ // this function.
137+ void modify_copy_via_strdup_ptr_001 (char ** p) { // $ ast-def=p
138+ // **p -> **p2
139+ char ** p2 = strdup_ptr_001 (p);
140+ // source -> **p2
141+ source_ref_ref (p2);
142+ }
143+
144+ void test_modify_copy_via_strdup_001 (char ** p) { // $ ast-def=p
145+ modify_copy_via_strdup_ptr_001 (p);
146+ sink (**p); // clean
147+ }
148+
149+ // This function copies the value of *p into a new location *p2 and then
150+ // taints **p2. Thus, **p contains tainted data after returning from this
151+ // function.
152+ void modify_copy_via_strdup_ptr_011 (char ** p) { // $ ast-def=p
153+ // **p -> **p2 and *p -> *p2
154+ char ** p2 = strdup_ptr_011 (p);
155+ // source -> **p2
156+ source_ref_ref (p2);
157+ }
158+
159+ void test_modify_copy_via_strdup_011 (char ** p) { // $ ast-def=p
160+ modify_copy_via_strdup_ptr_011 (p);
161+ sink (**p); // $ ir MISSING: ast
162+ }
163+
164+ char * source (int );
165+
166+ void source_ref_2 (char ** toTaint) { // $ ast-def=toTaint ir-def=*toTaint ir-def=**toTaint
167+ // source -> *toTaint
168+ *toTaint = source (42 );
169+ }
170+
171+ // This function copies the value of p into a new location p2 and then
172+ // taints *p2. Thus, *p contains tainted data after returning from this
173+ // function.
174+ void modify_copy_via_strdup_ptr_111_taint_ind (char ** p) { // $ ast-def=p
175+ // **p -> **p2, *p -> *p2, and p -> p2
176+ char ** p2 = strdup_ptr_111 (p);
177+ // source -> *p2
178+ source_ref_2 (p2);
179+ }
180+
181+ void sink (char *);
182+
183+ void test_modify_copy_via_strdup_111_taint_ind (char ** p) { // $ ast-def=p
184+ modify_copy_via_strdup_ptr_111_taint_ind (p);
185+ sink (*p); // $ ir MISSING: ast
186+ }
187+
188+ // This function copies the value of p into a new location p2 and then
189+ // taints **p2. Thus, **p contains tainted data after returning from this
190+ // function.
191+ void modify_copy_via_strdup_ptr_111_taint_ind_ind (char ** p) { // $ ast-def=p
192+ // **p -> **p2, *p -> *p2, and p -> p2
193+ char ** p2 = strdup_ptr_111 (p);
194+ // source -> **p2
195+ source_ref_ref (p2);
196+ }
197+
198+ void sink (char *);
199+
200+ void test_modify_copy_via_strdup_111_taint_ind_ind (char ** p) { // $ ast-def=p
201+ modify_copy_via_strdup_ptr_111_taint_ind_ind (p);
202+ sink (**p); // $ ir MISSING: ast
118203}
0 commit comments