C++: Add scanf_s models.

Author: MathiasVP

cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll

@@ -34,6 +34,7 @@ class Scanf extends ScanfFunction instanceof TopLevelFunction {
   Scanf() {
     this.hasGlobalOrStdOrBslName("scanf") or // scanf(format, args...)
     this.hasGlobalOrStdOrBslName("wscanf") or // wscanf(format, args...)
+    this.hasGlobalOrStdOrBslName("scanf_s") or // scanf_s(format, args...)
     this.hasGlobalName("_scanf_l") or // _scanf_l(format, locale, args...)
     this.hasGlobalName("_wscanf_l")
   }
@@ -50,6 +51,7 @@ class Fscanf extends ScanfFunction instanceof TopLevelFunction {
   Fscanf() {
     this.hasGlobalOrStdOrBslName("fscanf") or // fscanf(src_stream, format, args...)
     this.hasGlobalOrStdOrBslName("fwscanf") or // fwscanf(src_stream, format, args...)
+    this.hasGlobalOrStdOrBslName("fscanf_s") or // fscanf_s(src_stream, format, args...)
     this.hasGlobalName("_fscanf_l") or // _fscanf_l(src_stream, format, locale, args...)
     this.hasGlobalName("_fwscanf_l")
   }
@@ -66,8 +68,12 @@ class Sscanf extends ScanfFunction instanceof TopLevelFunction {
   Sscanf() {
     this.hasGlobalOrStdOrBslName("sscanf") or // sscanf(src_stream, format, args...)
     this.hasGlobalOrStdOrBslName("swscanf") or // swscanf(src, format, args...)
+    this.hasGlobalOrStdOrBslName("sscanf_s") or // sscanf_s(src, format, args...)
+    this.hasGlobalOrStdOrBslName("swscanf_s") or // swscanf_s(src, format, args...)
     this.hasGlobalName("_sscanf_l") or // _sscanf_l(src, format, locale, args...)
-    this.hasGlobalName("_swscanf_l")
+    this.hasGlobalName("_swscanf_l") or // _swscanf_l(src, format, locale, args...)
+    this.hasGlobalName("_sscanf_s_l") or // _sscanf_s_l(src, format, locale, args...)
+    this.hasGlobalName("_swscanf_s_l") // _swscanf_s_l(src, format, locale, args...)
   }
 
   override int getInputParameterIndex() { result = 0 }

cpp/ql/test/library-tests/dataflow/source-sink-tests/sources-and-sinks.cpp

@@ -140,32 +140,32 @@ void test_scanf_s(FILE *stream) {
   int n1, n2;
   scanf_s(
     "%d",
-    &n1, // $ MISSING: local_source
-    &n2); // $ MISSING: local_source
+    &n1, // $ local_source
+    &n2); // $ local_source
   }
 
   {
   int n;
-  fscanf_s(stream, "%d", &n); // $ MISSING: remote_source
+  fscanf_s(stream, "%d", &n); // $ remote_source
   }
 
   {
   int n1, n2;
   char buf[256];
   scanf_s("%d %s",
-    &n1, // $ MISSING: local_source
-    buf, // $ MISSING: local_source
+    &n1, // $ local_source
+    buf, // $ local_source
     256,
-    &n2); // $ MISSING: local_source
+    &n2); // $ local_source
   }
 
   {
   int n1, n2;
   char buf[256];
   fscanf_s(stream, "%d %s",
-    &n1, // $ MISSING: remote_source
-    buf, // $ MISSING: remote_source
+    &n1, // $ remote_source
+    buf, // $ remote_source
     256,
-    &n2); // $ MISSING: remote_source
+    &n2); // $ remote_source
   }
 }

cpp/ql/test/library-tests/scanf/scanfFormatLiteral.expected

@@ -3,3 +3,6 @@
 | test.c:20:2:20:7 | call to fscanf | 1 | i | 0 | 0 |
 | test.c:21:2:21:7 | call to sscanf | 0 | s | 0 | 0 |
 | test.c:22:2:22:8 | call to swscanf | 0 | s | 10 | 10 |
+| test.c:23:2:23:8 | call to scanf_s | 0 | d | 0 | 0 |
+| test.c:23:2:23:8 | call to scanf_s | 1 | s | 0 | 0 |
+| test.c:23:2:23:8 | call to scanf_s | 2 | d | 0 | 0 |

cpp/ql/test/library-tests/scanf/scanfFunctionCall.expected

@@ -3,3 +3,4 @@
 | test.c:20:2:20:7 | call to fscanf | 0 | 1 | test.c:20:15:20:23 | %10s %i | non-wide |
 | test.c:21:2:21:7 | call to sscanf | 0 | 1 | test.c:21:19:21:28 | %*i%s%*s | non-wide |
 | test.c:22:2:22:8 | call to swscanf | 0 | 1 | test.c:22:21:22:26 | %10s | wide |
+| test.c:23:2:23:8 | call to scanf_s | 0 | 0 | test.c:23:10:23:19 | %d %s %d | non-wide |

cpp/ql/test/library-tests/scanf/scanfFunctionCallOutput.expected

@@ -4,3 +4,7 @@
 | test.c:20:2:20:7 | call to fscanf | test.c:20:34:20:34 | i | 1 |
 | test.c:21:2:21:7 | call to sscanf | test.c:21:31:21:36 | buffer | 0 |
 | test.c:22:2:22:8 | call to swscanf | test.c:22:29:22:35 | wbuffer | 0 |
+| test.c:23:2:23:8 | call to scanf_s | test.c:23:22:23:23 | & ... | 0 |
+| test.c:23:2:23:8 | call to scanf_s | test.c:23:26:23:31 | buffer | 1 |
+| test.c:23:2:23:8 | call to scanf_s | test.c:23:34:23:35 | 10 | 2 |
+| test.c:23:2:23:8 | call to scanf_s | test.c:23:38:23:40 | & ... | 3 |