cpp: Model BDE Base64 and hex pointer-buffer conversions

cpp/ql/lib/change-notes/2026-09-14-bdlde-conversion-models.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added taint-flow models for direct pointer-buffer conversions using `BloombergLP::bdlde::Base64Encoder`, `Base64Decoder`, `HexEncoder`, and `HexDecoder`.

cpp/ql/lib/semmle/code/cpp/models/Models.qll

@@ -1,4 +1,5 @@
 private import implementations.Allocation
+private import implementations.Bdlde
 private import implementations.Deallocation
 private import implementations.Fopen
 private import implementations.Fread

cpp/ql/lib/semmle/code/cpp/models/implementations/Bdlde.qll

@@ -0,0 +1,32 @@
+/**
+ * Models direct pointer-buffer conversions in the BDE bdlde library.
+ * See https://github.com/bloomberg/bde/tree/ec310b87e008199ecbdbc00a0b0264a53d806a0a/groups/bdl/bdlde.
+ */
+
+import semmle.code.cpp.models.interfaces.Taint
+
+/** A conversion whose input and output iterators are pointers. */
+private class BdldePointerConversion extends TaintFunction {
+  int beginIndex;
+
+  BdldePointerConversion() {
+    this.hasName("convert") and
+    this.getDeclaringType()
+        .hasQualifiedName("BloombergLP::bdlde",
+          ["Base64Encoder", "Base64Decoder", "HexEncoder", "HexDecoder"]) and
+    (
+      this.getNumberOfParameters() = 3 and beginIndex = 1
+      or
+      this.getNumberOfParameters() = 6 and beginIndex = 3
+    ) and
+    // Check instantiated types. A generic template signature would also match
+    // iterator objects and replace their bodies with an inapplicable summary.
+    this.getParameter(0).getUnspecifiedType() instanceof PointerType and
+    this.getParameter(beginIndex).getUnspecifiedType() instanceof PointerType and
+    this.getParameter(beginIndex + 1).getUnspecifiedType() instanceof PointerType
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isParameterDeref(beginIndex) and output.isParameterDeref(0)
+  }
+}

cpp/ql/test/library-tests/dataflow/bdlde/bdlde.h

@@ -0,0 +1,38 @@
+// Minimal public declarations, with implementation bodies omitted to test the models.
+// https://github.com/bloomberg/bde/tree/ec310b87e008199ecbdbc00a0b0264a53d806a0a/groups/bdl/bdlde
+namespace BloombergLP {
+namespace bdlde {
+class Base64Encoder {
+public:
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, INPUT_ITERATOR begin, INPUT_ITERATOR end);
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, int *numOut, int *numIn,
+              INPUT_ITERATOR begin, INPUT_ITERATOR end, int maxNumOut = -1);
+};
+class Base64Decoder {
+public:
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, INPUT_ITERATOR begin, INPUT_ITERATOR end);
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, int *numOut, int *numIn,
+              INPUT_ITERATOR begin, INPUT_ITERATOR end, int maxNumOut = -1);
+};
+class HexEncoder {
+public:
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, INPUT_ITERATOR begin, INPUT_ITERATOR end);
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, int *numOut, int *numIn,
+              INPUT_ITERATOR begin, INPUT_ITERATOR end, int maxNumOut = -1);
+};
+class HexDecoder {
+public:
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, INPUT_ITERATOR begin, INPUT_ITERATOR end);
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, int *numOut, int *numIn,
+              INPUT_ITERATOR begin, INPUT_ITERATOR end, int maxNumOut = -1);
+};
+}
+}

cpp/ql/test/library-tests/dataflow/bdlde/flow.ql

@@ -0,0 +1,19 @@
+import cpp
+import utils.test.dataflow.FlowTestCommon
+import semmle.code.cpp.ir.dataflow.TaintTracking
+
+module Config implements DataFlow::ConfigSig {
+  predicate isSource(DataFlow::Node node) {
+    node.asExpr().(FunctionCall).getTarget().hasName("source")
+  }
+
+  predicate isSink(DataFlow::Node node) {
+    exists(FunctionCall call |
+      call.getTarget().hasName("sink") and node.asExpr() = call.getArgument(0)
+    )
+  }
+}
+
+module Flow = TaintTracking::Global<Config>;
+
+import MakeTest<IRFlowTest<Flow>>

cpp/ql/test/library-tests/dataflow/bdlde/iterators.cpp

@@ -0,0 +1,130 @@
+#include "bdlde.h"
+
+char source();
+void sink(char);
+
+// Reduced iterator access bodies: the object instantiations must remain
+// analyzable rather than being replaced by pointer-buffer summaries.
+struct InputIterator {
+  char value;
+  char operator*() const { return value; }
+};
+
+struct OutputIterator {
+  OutputIterator &operator*() { return *this; }
+  void operator=(char value) { sink(value); } // $ ir
+};
+
+namespace BloombergLP {
+namespace bdlde {
+template <class OUT, class IN>
+int Base64Encoder::convert(OUT out, IN begin, IN end) {
+  *out = *begin;
+  return 0;
+}
+
+template <class OUT, class IN>
+int Base64Encoder::convert(OUT out, int *numOut, int *numIn, IN begin, IN end, int limit) {
+  *out = *begin;
+  return 0;
+}
+template <class OUT, class IN>
+int Base64Decoder::convert(OUT out, IN begin, IN end) {
+  *out = *begin;
+  return 0;
+}
+
+template <class OUT, class IN>
+int Base64Decoder::convert(OUT out, int *numOut, int *numIn, IN begin, IN end, int limit) {
+  *out = *begin;
+  return 0;
+}
+template <class OUT, class IN>
+int HexEncoder::convert(OUT out, IN begin, IN end) {
+  *out = *begin;
+  return 0;
+}
+
+template <class OUT, class IN>
+int HexEncoder::convert(OUT out, int *numOut, int *numIn, IN begin, IN end, int limit) {
+  *out = *begin;
+  return 0;
+}
+template <class OUT, class IN>
+int HexDecoder::convert(OUT out, IN begin, IN end) {
+  *out = *begin;
+  return 0;
+}
+
+template <class OUT, class IN>
+int HexDecoder::convert(OUT out, int *numOut, int *numIn, IN begin, IN end, int limit) {
+  *out = *begin;
+  return 0;
+}
+}
+}
+
+void iteratorBase64Encoder() {
+  BloombergLP::bdlde::Base64Encoder converter;
+  InputIterator begin = {source()}, end = {0};
+  char shortOutput[4] = {};
+  converter.convert(shortOutput, begin, end);
+  sink(shortOutput[0]); // $ ir
+  int numOut = 0, numIn = 0;
+  char longOutput[4] = {};
+  converter.convert(longOutput, &numOut, &numIn, begin, end);
+  sink(longOutput[0]); // $ ir
+}
+
+void iteratorBase64Decoder() {
+  BloombergLP::bdlde::Base64Decoder converter;
+  InputIterator begin = {source()}, end = {0};
+  char shortOutput[4] = {};
+  converter.convert(shortOutput, begin, end);
+  sink(shortOutput[0]); // $ ir
+  int numOut = 0, numIn = 0;
+  char longOutput[4] = {};
+  converter.convert(longOutput, &numOut, &numIn, begin, end);
+  sink(longOutput[0]); // $ ir
+}
+
+void iteratorHexEncoder() {
+  BloombergLP::bdlde::HexEncoder converter;
+  InputIterator begin = {source()}, end = {0};
+  char shortOutput[4] = {};
+  converter.convert(shortOutput, begin, end);
+  sink(shortOutput[0]); // $ ir
+  int numOut = 0, numIn = 0;
+  char longOutput[4] = {};
+  converter.convert(longOutput, &numOut, &numIn, begin, end);
+  sink(longOutput[0]); // $ ir
+}
+
+void iteratorHexDecoder() {
+  BloombergLP::bdlde::HexDecoder converter;
+  InputIterator begin = {source()}, end = {0};
+  char shortOutput[4] = {};
+  converter.convert(shortOutput, begin, end);
+  sink(shortOutput[0]); // $ ir
+  int numOut = 0, numIn = 0;
+  char longOutput[4] = {};
+  converter.convert(longOutput, &numOut, &numIn, begin, end);
+  sink(longOutput[0]); // $ ir
+}
+
+template <class CONVERTER>
+void outputIterator() {
+  CONVERTER converter;
+  char input[] = {source()};
+  OutputIterator out;
+  converter.convert(out, input, input + 1);
+  int numOut = 0, numIn = 0;
+  converter.convert(out, &numOut, &numIn, input, input + 1);
+}
+
+void testOutputIterators() {
+  outputIterator<BloombergLP::bdlde::Base64Encoder>();
+  outputIterator<BloombergLP::bdlde::Base64Decoder>();
+  outputIterator<BloombergLP::bdlde::HexEncoder>();
+  outputIterator<BloombergLP::bdlde::HexDecoder>();
+}

cpp/ql/test/library-tests/dataflow/bdlde/test.cpp

@@ -0,0 +1,153 @@
+#include "bdlde.h"
+
+char source();
+void sink(char);
+
+void testBase64Encoder() {
+  BloombergLP::bdlde::Base64Encoder converter;
+  char input[] = {source(), 'A', 'A', 'A'};
+  const char *begin = input;
+  char shortOutput[32] = {};
+  converter.convert(shortOutput, input, input + 4);
+  sink(shortOutput[0]); // $ ir
+
+  int numOut = 0, numIn = 0;
+  char defaultLimitOutput[32] = {};
+  converter.convert(defaultLimitOutput, &numOut, &numIn, begin, begin + 4);
+  sink(defaultLimitOutput[0]); // $ ir
+
+  char explicitLimitOutput[32] = {};
+  converter.convert(explicitLimitOutput, &numOut, &numIn, begin, begin + 4, 32);
+  sink(explicitLimitOutput[0]); // $ ir
+}
+
+void testBase64EncoderNonInputs() {
+  BloombergLP::bdlde::Base64Encoder converter;
+  const char input[] = "AAAA";
+  int numOut = source(), numIn = source();
+  char output[32] = {};
+  converter.convert(output, &numOut, &numIn, input, input + 4);
+  sink(output[0]); // No flow from the pre-call values of the output counters.
+
+  char limitedOutput[32] = {};
+  converter.convert(limitedOutput, &numOut, &numIn, input, input + 4, source());
+  sink(limitedOutput[0]); // The output limit does not supply output bytes.
+}
+
+void testBase64Decoder() {
+  BloombergLP::bdlde::Base64Decoder converter;
+  char input[] = {source(), 'A', 'A', 'A'};
+  const char *begin = input;
+  char shortOutput[32] = {};
+  converter.convert(shortOutput, input, input + 4);
+  sink(shortOutput[0]); // $ ir
+
+  int numOut = 0, numIn = 0;
+  char defaultLimitOutput[32] = {};
+  converter.convert(defaultLimitOutput, &numOut, &numIn, begin, begin + 4);
+  sink(defaultLimitOutput[0]); // $ ir
+
+  char explicitLimitOutput[32] = {};
+  converter.convert(explicitLimitOutput, &numOut, &numIn, begin, begin + 4, 32);
+  sink(explicitLimitOutput[0]); // $ ir
+}
+
+void testBase64DecoderNonInputs() {
+  BloombergLP::bdlde::Base64Decoder converter;
+  const char input[] = "AAAA";
+  int numOut = source(), numIn = source();
+  char output[32] = {};
+  converter.convert(output, &numOut, &numIn, input, input + 4);
+  sink(output[0]); // No flow from the pre-call values of the output counters.
+
+  char limitedOutput[32] = {};
+  converter.convert(limitedOutput, &numOut, &numIn, input, input + 4, source());
+  sink(limitedOutput[0]); // The output limit does not supply output bytes.
+}
+
+void testHexEncoder() {
+  BloombergLP::bdlde::HexEncoder converter;
+  char input[] = {source(), 'A', 'A', 'A'};
+  const char *begin = input;
+  char shortOutput[32] = {};
+  converter.convert(shortOutput, input, input + 4);
+  sink(shortOutput[0]); // $ ir
+
+  int numOut = 0, numIn = 0;
+  char defaultLimitOutput[32] = {};
+  converter.convert(defaultLimitOutput, &numOut, &numIn, begin, begin + 4);
+  sink(defaultLimitOutput[0]); // $ ir
+
+  char explicitLimitOutput[32] = {};
+  converter.convert(explicitLimitOutput, &numOut, &numIn, begin, begin + 4, 32);
+  sink(explicitLimitOutput[0]); // $ ir
+}
+
+void testHexEncoderNonInputs() {
+  BloombergLP::bdlde::HexEncoder converter;
+  const char input[] = "AAAA";
+  int numOut = source(), numIn = source();
+  char output[32] = {};
+  converter.convert(output, &numOut, &numIn, input, input + 4);
+  sink(output[0]); // No flow from the pre-call values of the output counters.
+
+  char limitedOutput[32] = {};
+  converter.convert(limitedOutput, &numOut, &numIn, input, input + 4, source());
+  sink(limitedOutput[0]); // The output limit does not supply output bytes.
+}
+
+void testHexDecoder() {
+  BloombergLP::bdlde::HexDecoder converter;
+  char input[] = {source(), 'A', 'A', 'A'};
+  const char *begin = input;
+  char shortOutput[32] = {};
+  converter.convert(shortOutput, input, input + 4);
+  sink(shortOutput[0]); // $ ir
+
+  int numOut = 0, numIn = 0;
+  char defaultLimitOutput[32] = {};
+  converter.convert(defaultLimitOutput, &numOut, &numIn, begin, begin + 4);
+  sink(defaultLimitOutput[0]); // $ ir
+
+  char explicitLimitOutput[32] = {};
+  converter.convert(explicitLimitOutput, &numOut, &numIn, begin, begin + 4, 32);
+  sink(explicitLimitOutput[0]); // $ ir
+}
+
+void testHexDecoderNonInputs() {
+  BloombergLP::bdlde::HexDecoder converter;
+  const char input[] = "AAAA";
+  int numOut = source(), numIn = source();
+  char output[32] = {};
+  converter.convert(output, &numOut, &numIn, input, input + 4);
+  sink(output[0]); // No flow from the pre-call values of the output counters.
+
+  char limitedOutput[32] = {};
+  converter.convert(limitedOutput, &numOut, &numIn, input, input + 4, source());
+  sink(limitedOutput[0]); // The output limit does not supply output bytes.
+}
+
+// Inherited calls still target the method declared in Base64Encoder.
+struct DerivedEncoder : BloombergLP::bdlde::Base64Encoder {};
+
+void testInheritedConvert() {
+  DerivedEncoder converter;
+  char input[] = {source()};
+  char output[32] = {};
+  converter.convert(output, input, input + 1);
+  sink(output[0]); // $ ir
+}
+
+// A different method that hides convert must not inherit the summary.
+struct HidingEncoder : BloombergLP::bdlde::Base64Encoder {
+  template <class OUTPUT_ITERATOR, class INPUT_ITERATOR>
+  int convert(OUTPUT_ITERATOR out, INPUT_ITERATOR begin, INPUT_ITERATOR end);
+};
+
+void testHiddenConvert() {
+  HidingEncoder converter;
+  char input[] = {source()};
+  char output[32] = {};
+  converter.convert(output, input, input + 1);
+  sink(output[0]); // No modeled flow for the hiding method.
+}