From 77a4275fdc8b4b054461cefa1e1c0d298b033486 Mon Sep 17 00:00:00 2001 From: AkshayK Date: Thu, 27 Aug 2026 12:05:20 -0400 Subject: [PATCH] cpp: model BDE bslx in-stream deserialization taint flow Add flow summaries for the BDE byte-stream deserializers in BloombergLP::bslx: - ByteInStream and GenericInStream: constructing (or, for ByteInStream, reset-ing) from a buffer/streambuf taints the stream, and every get* method propagates that taint into its output variable. get* returns *this, so a fluent row keeps chained calls tainted. - InStreamFunctions::bdexStreamIn: the generic BDEX entry point that populates any bdex-compatible object from a stream, modeled as stream -> object. Not a duplicate of the bsl.* container models or the std/bsl QL models, which cover only the bsl standard-library-alike types; the bslx BDE namespace had no coverage. Verified with a BloombergLP::bslx-shaped stub in the dataflow external-models harness. --- .../change-notes/2026-08-27-bslx-models.md | 4 + cpp/ql/lib/ext/bslx.model.yml | 179 ++++++++++++++++ .../dataflow/external-models/bslx.cpp | 201 ++++++++++++++++++ .../dataflow/external-models/flow.expected | 95 ++++++++- .../dataflow/external-models/steps.expected | 179 ++++++++++++++++ 5 files changed, 656 insertions(+), 2 deletions(-) create mode 100644 cpp/ql/lib/change-notes/2026-08-27-bslx-models.md create mode 100644 cpp/ql/lib/ext/bslx.model.yml create mode 100644 cpp/ql/test/library-tests/dataflow/external-models/bslx.cpp diff --git a/cpp/ql/lib/change-notes/2026-08-27-bslx-models.md b/cpp/ql/lib/change-notes/2026-08-27-bslx-models.md new file mode 100644 index 000000000000..f10a9e2231f3 --- /dev/null +++ b/cpp/ql/lib/change-notes/2026-08-27-bslx-models.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Added flow summaries for the BDE `bslx` byte-stream deserializers (`BloombergLP::bslx`). Constructing a `ByteInStream` or `GenericInStream` from a byte buffer or streambuf taints the stream, each `get*` method (`getInt32`, `getString`, `getArray*`, ...) propagates that taint into the deserialized output (and keeps the returned stream tainted for chained calls), and `InStreamFunctions::bdexStreamIn` propagates taint from the stream to any deserialized object. diff --git a/cpp/ql/lib/ext/bslx.model.yml b/cpp/ql/lib/ext/bslx.model.yml new file mode 100644 index 000000000000..f92de8b43df3 --- /dev/null +++ b/cpp/ql/lib/ext/bslx.model.yml @@ -0,0 +1,179 @@ +# Model of the BDE `bslx` byte-stream deserializers (BloombergLP::bslx). +extensions: + - addsTo: + pack: codeql/cpp-all + extensible: summaryModel + data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance + # === bslx::ByteInStream: concrete byte-array in-stream === + # Taint in: the source buffer/streambuf taints the stream (`this`). + # Note: MaD taint is additive, so `reset` cannot clear taint from a previously + # tainted stream; a stream reset with a clean buffer keeps any earlier taint. + - ["BloombergLP::bslx", "ByteInStream", true, "ByteInStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "reset", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"] + # Taint out: the stream (`this`) taints the deserialized output variable/buffer. + - ["BloombergLP::bslx", "ByteInStream", true, "getLength", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getVersion", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + # Fluent interface: each get* returns `*this`, keeping the returned stream tainted. + - ["BloombergLP::bslx", "ByteInStream", true, "getLength", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getVersion", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getInt64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getString", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + # === bslx::GenericInStream: streambuf-backed in-stream === + # Taint in: the source buffer/streambuf taints the stream (`this`). + - ["BloombergLP::bslx", "GenericInStream", true, "GenericInStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"] + # Taint out: the stream (`this`) taints the deserialized output variable/buffer. + - ["BloombergLP::bslx", "GenericInStream", true, "getLength", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getVersion", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"] + # Fluent interface: each get* returns `*this`, keeping the returned stream tainted. + - ["BloombergLP::bslx", "GenericInStream", true, "getLength", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getVersion", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getInt64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getString", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + - ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"] + # === bslx::InStreamFunctions::bdexStreamIn: generic BDEX deserialization === + # Free function template; `InStreamFunctions` is a namespace, so `type` is empty. + - ["BloombergLP::bslx::InStreamFunctions", "", false, "bdexStreamIn", "", "", "Argument[*0]", "Argument[*1]", "taint", "manual"] + - ["BloombergLP::bslx::InStreamFunctions", "", false, "bdexStreamIn", "", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"] diff --git a/cpp/ql/test/library-tests/dataflow/external-models/bslx.cpp b/cpp/ql/test/library-tests/dataflow/external-models/bslx.cpp new file mode 100644 index 000000000000..9212230c7242 --- /dev/null +++ b/cpp/ql/test/library-tests/dataflow/external-models/bslx.cpp @@ -0,0 +1,201 @@ + +// --- stub library headers --- + +namespace std { + typedef unsigned long size_t; + template class allocator {}; + template struct char_traits {}; + template, class Allocator = allocator > + class basic_string { + public: + basic_string(); + basic_string(const charT* s, const Allocator& a = Allocator()); + const charT* data() const; + size_t size() const; + }; + typedef basic_string string; +} + +// BDE wraps every package-group namespace in `BloombergLP`; this stub reproduces that. +namespace BloombergLP { +namespace bslx { + class ByteInStream { + public: + ByteInStream(); + ByteInStream(const char *buffer, std::size_t numBytes); + void reset(const char *buffer, std::size_t numBytes); + ByteInStream &getLength(int &variable); + ByteInStream &getVersion(int &variable); + ByteInStream &getInt8(int &variable); + ByteInStream &getUint8(int &variable); + ByteInStream &getInt16(int &variable); + ByteInStream &getUint16(int &variable); + ByteInStream &getInt24(int &variable); + ByteInStream &getUint24(int &variable); + ByteInStream &getInt32(int &variable); + ByteInStream &getUint32(int &variable); + ByteInStream &getInt40(int &variable); + ByteInStream &getUint40(int &variable); + ByteInStream &getInt48(int &variable); + ByteInStream &getUint48(int &variable); + ByteInStream &getInt56(int &variable); + ByteInStream &getUint56(int &variable); + ByteInStream &getInt64(int &variable); + ByteInStream &getUint64(int &variable); + ByteInStream &getFloat32(int &variable); + ByteInStream &getFloat64(int &variable); + ByteInStream &getString(std::string &variable); + ByteInStream &getArrayInt8(char *variables, int numVariables); + ByteInStream &getArrayUint8(char *variables, int numVariables); + ByteInStream &getArrayInt16(char *variables, int numVariables); + ByteInStream &getArrayUint16(char *variables, int numVariables); + ByteInStream &getArrayInt24(char *variables, int numVariables); + ByteInStream &getArrayUint24(char *variables, int numVariables); + ByteInStream &getArrayInt32(char *variables, int numVariables); + ByteInStream &getArrayUint32(char *variables, int numVariables); + ByteInStream &getArrayInt40(char *variables, int numVariables); + ByteInStream &getArrayUint40(char *variables, int numVariables); + ByteInStream &getArrayInt48(char *variables, int numVariables); + ByteInStream &getArrayUint48(char *variables, int numVariables); + ByteInStream &getArrayInt56(char *variables, int numVariables); + ByteInStream &getArrayUint56(char *variables, int numVariables); + ByteInStream &getArrayInt64(char *variables, int numVariables); + ByteInStream &getArrayUint64(char *variables, int numVariables); + ByteInStream &getArrayFloat32(char *variables, int numVariables); + ByteInStream &getArrayFloat64(char *variables, int numVariables); + }; + + template + class GenericInStream { + public: + GenericInStream(STREAMBUF *streamBuf); + GenericInStream &getLength(int &variable); + GenericInStream &getVersion(int &variable); + GenericInStream &getInt8(int &variable); + GenericInStream &getUint8(int &variable); + GenericInStream &getInt16(int &variable); + GenericInStream &getUint16(int &variable); + GenericInStream &getInt24(int &variable); + GenericInStream &getUint24(int &variable); + GenericInStream &getInt32(int &variable); + GenericInStream &getUint32(int &variable); + GenericInStream &getInt40(int &variable); + GenericInStream &getUint40(int &variable); + GenericInStream &getInt48(int &variable); + GenericInStream &getUint48(int &variable); + GenericInStream &getInt56(int &variable); + GenericInStream &getUint56(int &variable); + GenericInStream &getInt64(int &variable); + GenericInStream &getUint64(int &variable); + GenericInStream &getFloat32(int &variable); + GenericInStream &getFloat64(int &variable); + GenericInStream &getString(std::string &variable); + GenericInStream &getArrayInt8(char *variables, int numVariables); + GenericInStream &getArrayUint8(char *variables, int numVariables); + GenericInStream &getArrayInt16(char *variables, int numVariables); + GenericInStream &getArrayUint16(char *variables, int numVariables); + GenericInStream &getArrayInt24(char *variables, int numVariables); + GenericInStream &getArrayUint24(char *variables, int numVariables); + GenericInStream &getArrayInt32(char *variables, int numVariables); + GenericInStream &getArrayUint32(char *variables, int numVariables); + GenericInStream &getArrayInt40(char *variables, int numVariables); + GenericInStream &getArrayUint40(char *variables, int numVariables); + GenericInStream &getArrayInt48(char *variables, int numVariables); + GenericInStream &getArrayUint48(char *variables, int numVariables); + GenericInStream &getArrayInt56(char *variables, int numVariables); + GenericInStream &getArrayUint56(char *variables, int numVariables); + GenericInStream &getArrayInt64(char *variables, int numVariables); + GenericInStream &getArrayUint64(char *variables, int numVariables); + GenericInStream &getArrayFloat32(char *variables, int numVariables); + GenericInStream &getArrayFloat64(char *variables, int numVariables); + }; + + namespace InStreamFunctions { + template + STREAM &bdexStreamIn(STREAM &stream, TYPE &variable); + } +} +} + +struct MyStreamBuf {}; + +char *source(); +void sink(int); +void sink(char); + +// --- flow tests (source -> sink) --- + +void test_ByteInStream_getInt32() { + std::string data = std::string(source()); + BloombergLP::bslx::ByteInStream stream(data.data(), data.size()); + int x = 0; + stream.getInt32(x); + sink(x); // $ ir +} + +void test_ByteInStream_getArrayInt8() { + std::string data = std::string(source()); + BloombergLP::bslx::ByteInStream stream(data.data(), data.size()); + char buf[16]; + stream.getArrayInt8(buf, 16); + sink(*buf); // $ ir +} + +void test_ByteInStream_getString() { + std::string data = std::string(source()); + BloombergLP::bslx::ByteInStream stream(data.data(), data.size()); + std::string out; + stream.getString(out); + sink(*out.data()); // $ ir +} + +void test_ByteInStream_chained() { + std::string data = std::string(source()); + BloombergLP::bslx::ByteInStream stream(data.data(), data.size()); + int a = 0; + int b = 0; + stream.getInt32(a).getInt32(b); + sink(b); // $ ir +} + +void test_ByteInStream_reset() { + BloombergLP::bslx::ByteInStream stream; + std::string data = std::string(source()); + stream.reset(data.data(), data.size()); + int x = 0; + stream.getInt32(x); + sink(x); // $ ir +} + +void test_GenericInStream_flow() { + std::string data = std::string(source()); + MyStreamBuf *sb = (MyStreamBuf *)data.data(); + BloombergLP::bslx::GenericInStream stream(sb); + int x = 0; + stream.getInt32(x); + sink(x); // $ ir +} + +void test_bdexStreamIn() { + std::string data = std::string(source()); + BloombergLP::bslx::ByteInStream stream(data.data(), data.size()); + int obj = 0; + BloombergLP::bslx::InStreamFunctions::bdexStreamIn(stream, obj); + sink(obj); // $ ir +} + +// --- coverage: call every modeled getter so steps.ql verifies each row is consumed --- + +void coverage_ByteInStream(BloombergLP::bslx::ByteInStream &stream) { + int iv = 0; + std::string str; + char cbuf[16]; + stream.getLength(iv).getVersion(iv).getInt8(iv).getUint8(iv).getInt16(iv).getUint16(iv).getInt24(iv).getUint24(iv).getInt32(iv).getUint32(iv).getInt40(iv).getUint40(iv).getInt48(iv).getUint48(iv).getInt56(iv).getUint56(iv).getInt64(iv).getUint64(iv).getFloat32(iv).getFloat64(iv).getString(str).getArrayInt8(cbuf, 16).getArrayUint8(cbuf, 16).getArrayInt16(cbuf, 16).getArrayUint16(cbuf, 16).getArrayInt24(cbuf, 16).getArrayUint24(cbuf, 16).getArrayInt32(cbuf, 16).getArrayUint32(cbuf, 16).getArrayInt40(cbuf, 16).getArrayUint40(cbuf, 16).getArrayInt48(cbuf, 16).getArrayUint48(cbuf, 16).getArrayInt56(cbuf, 16).getArrayUint56(cbuf, 16).getArrayInt64(cbuf, 16).getArrayUint64(cbuf, 16).getArrayFloat32(cbuf, 16).getArrayFloat64(cbuf, 16); +} + +void coverage_GenericInStream(BloombergLP::bslx::GenericInStream &stream) { + int iv = 0; + std::string str; + char cbuf[16]; + stream.getLength(iv).getVersion(iv).getInt8(iv).getUint8(iv).getInt16(iv).getUint16(iv).getInt24(iv).getUint24(iv).getInt32(iv).getUint32(iv).getInt40(iv).getUint40(iv).getInt48(iv).getUint48(iv).getInt56(iv).getUint56(iv).getInt64(iv).getUint64(iv).getFloat32(iv).getFloat64(iv).getString(str).getArrayInt8(cbuf, 16).getArrayUint8(cbuf, 16).getArrayInt16(cbuf, 16).getArrayUint16(cbuf, 16).getArrayInt24(cbuf, 16).getArrayUint24(cbuf, 16).getArrayInt32(cbuf, 16).getArrayUint32(cbuf, 16).getArrayInt40(cbuf, 16).getArrayUint40(cbuf, 16).getArrayInt48(cbuf, 16).getArrayUint48(cbuf, 16).getArrayInt56(cbuf, 16).getArrayUint56(cbuf, 16).getArrayInt64(cbuf, 16).getArrayUint64(cbuf, 16).getArrayFloat32(cbuf, 16).getArrayFloat64(cbuf, 16); +} diff --git a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected index b6f5f4a4452f..bcf6caee6dc3 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected @@ -95,7 +95,16 @@ models | 94 | Summary: Azure::Core::IO; BodyStream; true; ReadToCount; ; ; Argument[-1]; Argument[*0]; taint; manual | | 95 | Summary: Azure::Core::IO; BodyStream; true; ReadToEnd; ; ; Argument[-1]; ReturnValue.Element; taint; manual | | 96 | Summary: Azure; Nullable; true; Value; ; ; Argument[-1]; ReturnValue[*]; taint; manual | -| 97 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual | +| 97 | Summary: BloombergLP::bslx::InStreamFunctions; ; false; bdexStreamIn; ; ; Argument[*0]; Argument[*1]; taint; manual | +| 98 | Summary: BloombergLP::bslx; ByteInStream; true; ByteInStream; ; ; Argument[*0]; Argument[-1]; taint; manual | +| 99 | Summary: BloombergLP::bslx; ByteInStream; true; getArrayInt8; ; ; Argument[-1]; Argument[*0]; taint; manual | +| 100 | Summary: BloombergLP::bslx; ByteInStream; true; getInt32; ; ; Argument[-1]; Argument[*0]; taint; manual | +| 101 | Summary: BloombergLP::bslx; ByteInStream; true; getInt32; ; ; Argument[-1]; ReturnValue[*]; taint; manual | +| 102 | Summary: BloombergLP::bslx; ByteInStream; true; getString; ; ; Argument[-1]; Argument[*0]; taint; manual | +| 103 | Summary: BloombergLP::bslx; ByteInStream; true; reset; ; ; Argument[*0]; Argument[-1]; taint; manual | +| 104 | Summary: BloombergLP::bslx; GenericInStream; true; GenericInStream; ; ; Argument[*0]; Argument[-1]; taint; manual | +| 105 | Summary: BloombergLP::bslx; GenericInStream; true; getInt32; ; ; Argument[-1]; Argument[*0]; taint; manual | +| 106 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual | edges | asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:91:7:91:17 | recv_buffer | provenance | Src:MaD:56 | | asio_streams.cpp:87:34:87:44 | read_until output argument | asio_streams.cpp:93:29:93:39 | recv_buffer | provenance | Src:MaD:56 Sink:MaD:4 | @@ -104,7 +113,7 @@ edges | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | | | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:101:7:101:17 | send_buffer | provenance | | | asio_streams.cpp:100:44:100:62 | call to buffer | asio_streams.cpp:103:29:103:39 | send_buffer | provenance | Sink:MaD:4 | -| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:97 | +| asio_streams.cpp:100:64:100:71 | *send_str | asio_streams.cpp:100:44:100:62 | call to buffer | provenance | MaD:106 | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:257:5:257:8 | *resp | provenance | | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:262:5:262:8 | *resp | provenance | | | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:266:38:266:41 | *resp | provenance | | @@ -144,6 +153,44 @@ edges | azure.cpp:294:38:294:53 | call to operator[] | azure.cpp:295:10:295:20 | contentType | provenance | | | azure.cpp:294:38:294:53 | call to operator[] | azure.cpp:295:10:295:20 | contentType | provenance | | | azure.cpp:295:10:295:20 | contentType | azure.cpp:295:10:295:20 | contentType | provenance | | +| bslx.cpp:129:33:129:40 | call to source | bslx.cpp:130:46:130:49 | *call to data | provenance | TaintFunction | +| bslx.cpp:130:34:130:39 | call to ByteInStream | bslx.cpp:132:2:132:7 | *stream | provenance | | +| bslx.cpp:130:46:130:49 | *call to data | bslx.cpp:130:34:130:39 | call to ByteInStream | provenance | MaD:98 | +| bslx.cpp:132:2:132:7 | *stream | bslx.cpp:132:18:132:18 | getInt32 output argument | provenance | MaD:100 | +| bslx.cpp:132:18:132:18 | getInt32 output argument | bslx.cpp:133:7:133:7 | x | provenance | | +| bslx.cpp:137:33:137:40 | call to source | bslx.cpp:138:46:138:49 | *call to data | provenance | TaintFunction | +| bslx.cpp:138:34:138:39 | call to ByteInStream | bslx.cpp:140:2:140:7 | *stream | provenance | | +| bslx.cpp:138:46:138:49 | *call to data | bslx.cpp:138:34:138:39 | call to ByteInStream | provenance | MaD:98 | +| bslx.cpp:140:2:140:7 | *stream | bslx.cpp:140:22:140:24 | getArrayInt8 output argument | provenance | MaD:99 | +| bslx.cpp:140:22:140:24 | getArrayInt8 output argument | bslx.cpp:141:7:141:10 | * ... | provenance | | +| bslx.cpp:145:33:145:40 | call to source | bslx.cpp:146:46:146:49 | *call to data | provenance | TaintFunction | +| bslx.cpp:146:34:146:39 | call to ByteInStream | bslx.cpp:148:2:148:7 | *stream | provenance | | +| bslx.cpp:146:46:146:49 | *call to data | bslx.cpp:146:34:146:39 | call to ByteInStream | provenance | MaD:98 | +| bslx.cpp:148:2:148:7 | *stream | bslx.cpp:148:19:148:21 | getString output argument | provenance | MaD:102 | +| bslx.cpp:148:19:148:21 | getString output argument | bslx.cpp:149:7:149:17 | * ... | provenance | TaintFunction | +| bslx.cpp:153:33:153:40 | call to source | bslx.cpp:154:46:154:49 | *call to data | provenance | TaintFunction | +| bslx.cpp:154:34:154:39 | call to ByteInStream | bslx.cpp:157:2:157:7 | *stream | provenance | | +| bslx.cpp:154:46:154:49 | *call to data | bslx.cpp:154:34:154:39 | call to ByteInStream | provenance | MaD:98 | +| bslx.cpp:157:2:157:7 | *stream | bslx.cpp:157:17:157:20 | *call to getInt32 | provenance | MaD:101 | +| bslx.cpp:157:17:157:20 | *call to getInt32 | bslx.cpp:157:30:157:30 | getInt32 output argument | provenance | MaD:100 | +| bslx.cpp:157:30:157:30 | getInt32 output argument | bslx.cpp:158:7:158:7 | b | provenance | | +| bslx.cpp:163:33:163:40 | call to source | bslx.cpp:164:20:164:23 | *call to data | provenance | TaintFunction | +| bslx.cpp:164:2:164:7 | reset output argument | bslx.cpp:166:2:166:7 | *stream | provenance | | +| bslx.cpp:164:20:164:23 | *call to data | bslx.cpp:164:2:164:7 | reset output argument | provenance | MaD:103 | +| bslx.cpp:166:2:166:7 | *stream | bslx.cpp:166:18:166:18 | getInt32 output argument | provenance | MaD:100 | +| bslx.cpp:166:18:166:18 | getInt32 output argument | bslx.cpp:167:7:167:7 | x | provenance | | +| bslx.cpp:171:33:171:40 | call to source | bslx.cpp:172:20:172:45 | *call to data | provenance | TaintFunction | +| bslx.cpp:172:20:172:45 | *call to data | bslx.cpp:173:57:173:58 | *sb | provenance | | +| bslx.cpp:172:20:172:45 | *call to data | bslx.cpp:175:2:175:7 | *stream | provenance | TaintFunction | +| bslx.cpp:173:50:173:55 | call to GenericInStream | bslx.cpp:175:2:175:7 | *stream | provenance | | +| bslx.cpp:173:57:173:58 | *sb | bslx.cpp:173:50:173:55 | call to GenericInStream | provenance | MaD:104 | +| bslx.cpp:175:2:175:7 | *stream | bslx.cpp:175:18:175:18 | getInt32 output argument | provenance | MaD:105 | +| bslx.cpp:175:18:175:18 | getInt32 output argument | bslx.cpp:176:7:176:7 | x | provenance | | +| bslx.cpp:180:33:180:40 | call to source | bslx.cpp:181:46:181:49 | *call to data | provenance | TaintFunction | +| bslx.cpp:181:34:181:39 | call to ByteInStream | bslx.cpp:183:53:183:58 | *stream | provenance | | +| bslx.cpp:181:46:181:49 | *call to data | bslx.cpp:181:34:181:39 | call to ByteInStream | provenance | MaD:98 | +| bslx.cpp:183:53:183:58 | *stream | bslx.cpp:183:61:183:63 | bdexStreamIn output argument | provenance | MaD:97 | +| bslx.cpp:183:61:183:63 | bdexStreamIn output argument | bslx.cpp:184:7:184:9 | obj | provenance | | | test.cpp:7:47:7:52 | value2 | test.cpp:7:64:7:69 | value2 | provenance | | | test.cpp:7:64:7:69 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | provenance | | | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:48 | @@ -532,6 +579,50 @@ nodes | azure.cpp:295:10:295:20 | contentType | semmle.label | contentType | | azure.cpp:295:10:295:20 | contentType | semmle.label | contentType | | azure.cpp:295:10:295:20 | contentType | semmle.label | contentType | +| bslx.cpp:129:33:129:40 | call to source | semmle.label | call to source | +| bslx.cpp:130:34:130:39 | call to ByteInStream | semmle.label | call to ByteInStream | +| bslx.cpp:130:46:130:49 | *call to data | semmle.label | *call to data | +| bslx.cpp:132:2:132:7 | *stream | semmle.label | *stream | +| bslx.cpp:132:18:132:18 | getInt32 output argument | semmle.label | getInt32 output argument | +| bslx.cpp:133:7:133:7 | x | semmle.label | x | +| bslx.cpp:137:33:137:40 | call to source | semmle.label | call to source | +| bslx.cpp:138:34:138:39 | call to ByteInStream | semmle.label | call to ByteInStream | +| bslx.cpp:138:46:138:49 | *call to data | semmle.label | *call to data | +| bslx.cpp:140:2:140:7 | *stream | semmle.label | *stream | +| bslx.cpp:140:22:140:24 | getArrayInt8 output argument | semmle.label | getArrayInt8 output argument | +| bslx.cpp:141:7:141:10 | * ... | semmle.label | * ... | +| bslx.cpp:145:33:145:40 | call to source | semmle.label | call to source | +| bslx.cpp:146:34:146:39 | call to ByteInStream | semmle.label | call to ByteInStream | +| bslx.cpp:146:46:146:49 | *call to data | semmle.label | *call to data | +| bslx.cpp:148:2:148:7 | *stream | semmle.label | *stream | +| bslx.cpp:148:19:148:21 | getString output argument | semmle.label | getString output argument | +| bslx.cpp:149:7:149:17 | * ... | semmle.label | * ... | +| bslx.cpp:153:33:153:40 | call to source | semmle.label | call to source | +| bslx.cpp:154:34:154:39 | call to ByteInStream | semmle.label | call to ByteInStream | +| bslx.cpp:154:46:154:49 | *call to data | semmle.label | *call to data | +| bslx.cpp:157:2:157:7 | *stream | semmle.label | *stream | +| bslx.cpp:157:17:157:20 | *call to getInt32 | semmle.label | *call to getInt32 | +| bslx.cpp:157:30:157:30 | getInt32 output argument | semmle.label | getInt32 output argument | +| bslx.cpp:158:7:158:7 | b | semmle.label | b | +| bslx.cpp:163:33:163:40 | call to source | semmle.label | call to source | +| bslx.cpp:164:2:164:7 | reset output argument | semmle.label | reset output argument | +| bslx.cpp:164:20:164:23 | *call to data | semmle.label | *call to data | +| bslx.cpp:166:2:166:7 | *stream | semmle.label | *stream | +| bslx.cpp:166:18:166:18 | getInt32 output argument | semmle.label | getInt32 output argument | +| bslx.cpp:167:7:167:7 | x | semmle.label | x | +| bslx.cpp:171:33:171:40 | call to source | semmle.label | call to source | +| bslx.cpp:172:20:172:45 | *call to data | semmle.label | *call to data | +| bslx.cpp:173:50:173:55 | call to GenericInStream | semmle.label | call to GenericInStream | +| bslx.cpp:173:57:173:58 | *sb | semmle.label | *sb | +| bslx.cpp:175:2:175:7 | *stream | semmle.label | *stream | +| bslx.cpp:175:18:175:18 | getInt32 output argument | semmle.label | getInt32 output argument | +| bslx.cpp:176:7:176:7 | x | semmle.label | x | +| bslx.cpp:180:33:180:40 | call to source | semmle.label | call to source | +| bslx.cpp:181:34:181:39 | call to ByteInStream | semmle.label | call to ByteInStream | +| bslx.cpp:181:46:181:49 | *call to data | semmle.label | *call to data | +| bslx.cpp:183:53:183:58 | *stream | semmle.label | *stream | +| bslx.cpp:183:61:183:63 | bdexStreamIn output argument | semmle.label | bdexStreamIn output argument | +| bslx.cpp:184:7:184:9 | obj | semmle.label | obj | | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | semmle.label | *ymlStepGenerated_with_body | | test.cpp:7:47:7:52 | value2 | semmle.label | value2 | | test.cpp:7:64:7:69 | value2 | semmle.label | value2 | diff --git a/cpp/ql/test/library-tests/dataflow/external-models/steps.expected b/cpp/ql/test/library-tests/dataflow/external-models/steps.expected index 0fe13460cfbf..4c99ac379e57 100644 --- a/cpp/ql/test/library-tests/dataflow/external-models/steps.expected +++ b/cpp/ql/test/library-tests/dataflow/external-models/steps.expected @@ -4,6 +4,185 @@ | azure.cpp:262:5:262:8 | *resp | azure.cpp:262:23:262:28 | ReadToCount output argument | | azure.cpp:287:79:287:98 | call to string | azure.cpp:287:62:287:99 | call to Url | | azure.cpp:289:24:289:56 | call to GetHeader | azure.cpp:289:63:289:65 | call to Value | +| bslx.cpp:130:46:130:49 | *call to data | bslx.cpp:130:34:130:39 | call to ByteInStream | +| bslx.cpp:132:2:132:7 | *stream | bslx.cpp:132:17:132:20 | *call to getInt32 | +| bslx.cpp:132:2:132:7 | *stream | bslx.cpp:132:18:132:18 | getInt32 output argument | +| bslx.cpp:138:46:138:49 | *call to data | bslx.cpp:138:34:138:39 | call to ByteInStream | +| bslx.cpp:140:2:140:7 | *stream | bslx.cpp:140:21:140:30 | *call to getArrayInt8 | +| bslx.cpp:140:2:140:7 | *stream | bslx.cpp:140:22:140:24 | getArrayInt8 output argument | +| bslx.cpp:146:46:146:49 | *call to data | bslx.cpp:146:34:146:39 | call to ByteInStream | +| bslx.cpp:148:2:148:7 | *stream | bslx.cpp:148:18:148:23 | *call to getString | +| bslx.cpp:148:2:148:7 | *stream | bslx.cpp:148:19:148:21 | getString output argument | +| bslx.cpp:154:46:154:49 | *call to data | bslx.cpp:154:34:154:39 | call to ByteInStream | +| bslx.cpp:157:2:157:7 | *stream | bslx.cpp:157:17:157:20 | *call to getInt32 | +| bslx.cpp:157:2:157:7 | *stream | bslx.cpp:157:18:157:18 | getInt32 output argument | +| bslx.cpp:157:17:157:20 | *call to getInt32 | bslx.cpp:157:29:157:32 | *call to getInt32 | +| bslx.cpp:157:17:157:20 | *call to getInt32 | bslx.cpp:157:30:157:30 | getInt32 output argument | +| bslx.cpp:164:20:164:23 | *call to data | bslx.cpp:164:2:164:7 | reset output argument | +| bslx.cpp:166:2:166:7 | *stream | bslx.cpp:166:17:166:20 | *call to getInt32 | +| bslx.cpp:166:2:166:7 | *stream | bslx.cpp:166:18:166:18 | getInt32 output argument | +| bslx.cpp:173:57:173:58 | *sb | bslx.cpp:173:50:173:55 | call to GenericInStream | +| bslx.cpp:175:2:175:7 | *stream | bslx.cpp:175:17:175:20 | *call to getInt32 | +| bslx.cpp:175:2:175:7 | *stream | bslx.cpp:175:18:175:18 | getInt32 output argument | +| bslx.cpp:181:46:181:49 | *call to data | bslx.cpp:181:34:181:39 | call to ByteInStream | +| bslx.cpp:183:53:183:58 | *stream | bslx.cpp:183:52:183:65 | *call to bdexStreamIn | +| bslx.cpp:183:53:183:58 | *stream | bslx.cpp:183:61:183:63 | bdexStreamIn output argument | +| bslx.cpp:193:2:193:7 | *stream | bslx.cpp:193:18:193:22 | *call to getLength | +| bslx.cpp:193:2:193:7 | *stream | bslx.cpp:193:19:193:20 | getLength output argument | +| bslx.cpp:193:18:193:22 | *call to getLength | bslx.cpp:193:33:193:37 | *call to getVersion | +| bslx.cpp:193:18:193:22 | *call to getLength | bslx.cpp:193:34:193:35 | getVersion output argument | +| bslx.cpp:193:33:193:37 | *call to getVersion | bslx.cpp:193:45:193:49 | *call to getInt8 | +| bslx.cpp:193:33:193:37 | *call to getVersion | bslx.cpp:193:46:193:47 | getInt8 output argument | +| bslx.cpp:193:45:193:49 | *call to getInt8 | bslx.cpp:193:58:193:62 | *call to getUint8 | +| bslx.cpp:193:45:193:49 | *call to getInt8 | bslx.cpp:193:59:193:60 | getUint8 output argument | +| bslx.cpp:193:58:193:62 | *call to getUint8 | bslx.cpp:193:71:193:75 | *call to getInt16 | +| bslx.cpp:193:58:193:62 | *call to getUint8 | bslx.cpp:193:72:193:73 | getInt16 output argument | +| bslx.cpp:193:71:193:75 | *call to getInt16 | bslx.cpp:193:85:193:89 | *call to getUint16 | +| bslx.cpp:193:71:193:75 | *call to getInt16 | bslx.cpp:193:86:193:87 | getUint16 output argument | +| bslx.cpp:193:85:193:89 | *call to getUint16 | bslx.cpp:193:98:193:102 | *call to getInt24 | +| bslx.cpp:193:85:193:89 | *call to getUint16 | bslx.cpp:193:99:193:100 | getInt24 output argument | +| bslx.cpp:193:98:193:102 | *call to getInt24 | bslx.cpp:193:112:193:116 | *call to getUint24 | +| bslx.cpp:193:98:193:102 | *call to getInt24 | bslx.cpp:193:113:193:114 | getUint24 output argument | +| bslx.cpp:193:112:193:116 | *call to getUint24 | bslx.cpp:193:125:193:129 | *call to getInt32 | +| bslx.cpp:193:112:193:116 | *call to getUint24 | bslx.cpp:193:126:193:127 | getInt32 output argument | +| bslx.cpp:193:125:193:129 | *call to getInt32 | bslx.cpp:193:139:193:143 | *call to getUint32 | +| bslx.cpp:193:125:193:129 | *call to getInt32 | bslx.cpp:193:140:193:141 | getUint32 output argument | +| bslx.cpp:193:139:193:143 | *call to getUint32 | bslx.cpp:193:152:193:156 | *call to getInt40 | +| bslx.cpp:193:139:193:143 | *call to getUint32 | bslx.cpp:193:153:193:154 | getInt40 output argument | +| bslx.cpp:193:152:193:156 | *call to getInt40 | bslx.cpp:193:166:193:170 | *call to getUint40 | +| bslx.cpp:193:152:193:156 | *call to getInt40 | bslx.cpp:193:167:193:168 | getUint40 output argument | +| bslx.cpp:193:166:193:170 | *call to getUint40 | bslx.cpp:193:179:193:183 | *call to getInt48 | +| bslx.cpp:193:166:193:170 | *call to getUint40 | bslx.cpp:193:180:193:181 | getInt48 output argument | +| bslx.cpp:193:179:193:183 | *call to getInt48 | bslx.cpp:193:193:193:197 | *call to getUint48 | +| bslx.cpp:193:179:193:183 | *call to getInt48 | bslx.cpp:193:194:193:195 | getUint48 output argument | +| bslx.cpp:193:193:193:197 | *call to getUint48 | bslx.cpp:193:206:193:210 | *call to getInt56 | +| bslx.cpp:193:193:193:197 | *call to getUint48 | bslx.cpp:193:207:193:208 | getInt56 output argument | +| bslx.cpp:193:206:193:210 | *call to getInt56 | bslx.cpp:193:220:193:224 | *call to getUint56 | +| bslx.cpp:193:206:193:210 | *call to getInt56 | bslx.cpp:193:221:193:222 | getUint56 output argument | +| bslx.cpp:193:220:193:224 | *call to getUint56 | bslx.cpp:193:233:193:237 | *call to getInt64 | +| bslx.cpp:193:220:193:224 | *call to getUint56 | bslx.cpp:193:234:193:235 | getInt64 output argument | +| bslx.cpp:193:233:193:237 | *call to getInt64 | bslx.cpp:193:247:193:251 | *call to getUint64 | +| bslx.cpp:193:233:193:237 | *call to getInt64 | bslx.cpp:193:248:193:249 | getUint64 output argument | +| bslx.cpp:193:247:193:251 | *call to getUint64 | bslx.cpp:193:262:193:266 | *call to getFloat32 | +| bslx.cpp:193:247:193:251 | *call to getUint64 | bslx.cpp:193:263:193:264 | getFloat32 output argument | +| bslx.cpp:193:262:193:266 | *call to getFloat32 | bslx.cpp:193:277:193:281 | *call to getFloat64 | +| bslx.cpp:193:262:193:266 | *call to getFloat32 | bslx.cpp:193:278:193:279 | getFloat64 output argument | +| bslx.cpp:193:277:193:281 | *call to getFloat64 | bslx.cpp:193:291:193:296 | *call to getString | +| bslx.cpp:193:277:193:281 | *call to getFloat64 | bslx.cpp:193:292:193:294 | getString output argument | +| bslx.cpp:193:291:193:296 | *call to getString | bslx.cpp:193:309:193:319 | *call to getArrayInt8 | +| bslx.cpp:193:291:193:296 | *call to getString | bslx.cpp:193:310:193:313 | getArrayInt8 output argument | +| bslx.cpp:193:309:193:319 | *call to getArrayInt8 | bslx.cpp:193:333:193:343 | *call to getArrayUint8 | +| bslx.cpp:193:309:193:319 | *call to getArrayInt8 | bslx.cpp:193:334:193:337 | getArrayUint8 output argument | +| bslx.cpp:193:333:193:343 | *call to getArrayUint8 | bslx.cpp:193:357:193:367 | *call to getArrayInt16 | +| bslx.cpp:193:333:193:343 | *call to getArrayUint8 | bslx.cpp:193:358:193:361 | getArrayInt16 output argument | +| bslx.cpp:193:357:193:367 | *call to getArrayInt16 | bslx.cpp:193:382:193:392 | *call to getArrayUint16 | +| bslx.cpp:193:357:193:367 | *call to getArrayInt16 | bslx.cpp:193:383:193:386 | getArrayUint16 output argument | +| bslx.cpp:193:382:193:392 | *call to getArrayUint16 | bslx.cpp:193:406:193:416 | *call to getArrayInt24 | +| bslx.cpp:193:382:193:392 | *call to getArrayUint16 | bslx.cpp:193:407:193:410 | getArrayInt24 output argument | +| bslx.cpp:193:406:193:416 | *call to getArrayInt24 | bslx.cpp:193:431:193:441 | *call to getArrayUint24 | +| bslx.cpp:193:406:193:416 | *call to getArrayInt24 | bslx.cpp:193:432:193:435 | getArrayUint24 output argument | +| bslx.cpp:193:431:193:441 | *call to getArrayUint24 | bslx.cpp:193:455:193:465 | *call to getArrayInt32 | +| bslx.cpp:193:431:193:441 | *call to getArrayUint24 | bslx.cpp:193:456:193:459 | getArrayInt32 output argument | +| bslx.cpp:193:455:193:465 | *call to getArrayInt32 | bslx.cpp:193:480:193:490 | *call to getArrayUint32 | +| bslx.cpp:193:455:193:465 | *call to getArrayInt32 | bslx.cpp:193:481:193:484 | getArrayUint32 output argument | +| bslx.cpp:193:480:193:490 | *call to getArrayUint32 | bslx.cpp:193:504:193:514 | *call to getArrayInt40 | +| bslx.cpp:193:480:193:490 | *call to getArrayUint32 | bslx.cpp:193:505:193:508 | getArrayInt40 output argument | +| bslx.cpp:193:504:193:514 | *call to getArrayInt40 | bslx.cpp:193:529:193:539 | *call to getArrayUint40 | +| bslx.cpp:193:504:193:514 | *call to getArrayInt40 | bslx.cpp:193:530:193:533 | getArrayUint40 output argument | +| bslx.cpp:193:529:193:539 | *call to getArrayUint40 | bslx.cpp:193:553:193:563 | *call to getArrayInt48 | +| bslx.cpp:193:529:193:539 | *call to getArrayUint40 | bslx.cpp:193:554:193:557 | getArrayInt48 output argument | +| bslx.cpp:193:553:193:563 | *call to getArrayInt48 | bslx.cpp:193:578:193:588 | *call to getArrayUint48 | +| bslx.cpp:193:553:193:563 | *call to getArrayInt48 | bslx.cpp:193:579:193:582 | getArrayUint48 output argument | +| bslx.cpp:193:578:193:588 | *call to getArrayUint48 | bslx.cpp:193:602:193:612 | *call to getArrayInt56 | +| bslx.cpp:193:578:193:588 | *call to getArrayUint48 | bslx.cpp:193:603:193:606 | getArrayInt56 output argument | +| bslx.cpp:193:602:193:612 | *call to getArrayInt56 | bslx.cpp:193:627:193:637 | *call to getArrayUint56 | +| bslx.cpp:193:602:193:612 | *call to getArrayInt56 | bslx.cpp:193:628:193:631 | getArrayUint56 output argument | +| bslx.cpp:193:627:193:637 | *call to getArrayUint56 | bslx.cpp:193:651:193:661 | *call to getArrayInt64 | +| bslx.cpp:193:627:193:637 | *call to getArrayUint56 | bslx.cpp:193:652:193:655 | getArrayInt64 output argument | +| bslx.cpp:193:651:193:661 | *call to getArrayInt64 | bslx.cpp:193:676:193:686 | *call to getArrayUint64 | +| bslx.cpp:193:651:193:661 | *call to getArrayInt64 | bslx.cpp:193:677:193:680 | getArrayUint64 output argument | +| bslx.cpp:193:676:193:686 | *call to getArrayUint64 | bslx.cpp:193:702:193:712 | *call to getArrayFloat32 | +| bslx.cpp:193:676:193:686 | *call to getArrayUint64 | bslx.cpp:193:703:193:706 | getArrayFloat32 output argument | +| bslx.cpp:193:702:193:712 | *call to getArrayFloat32 | bslx.cpp:193:728:193:738 | *call to getArrayFloat64 | +| bslx.cpp:193:702:193:712 | *call to getArrayFloat32 | bslx.cpp:193:729:193:732 | getArrayFloat64 output argument | +| bslx.cpp:200:2:200:7 | *stream | bslx.cpp:200:18:200:22 | *call to getLength | +| bslx.cpp:200:2:200:7 | *stream | bslx.cpp:200:19:200:20 | getLength output argument | +| bslx.cpp:200:18:200:22 | *call to getLength | bslx.cpp:200:33:200:37 | *call to getVersion | +| bslx.cpp:200:18:200:22 | *call to getLength | bslx.cpp:200:34:200:35 | getVersion output argument | +| bslx.cpp:200:33:200:37 | *call to getVersion | bslx.cpp:200:45:200:49 | *call to getInt8 | +| bslx.cpp:200:33:200:37 | *call to getVersion | bslx.cpp:200:46:200:47 | getInt8 output argument | +| bslx.cpp:200:45:200:49 | *call to getInt8 | bslx.cpp:200:58:200:62 | *call to getUint8 | +| bslx.cpp:200:45:200:49 | *call to getInt8 | bslx.cpp:200:59:200:60 | getUint8 output argument | +| bslx.cpp:200:58:200:62 | *call to getUint8 | bslx.cpp:200:71:200:75 | *call to getInt16 | +| bslx.cpp:200:58:200:62 | *call to getUint8 | bslx.cpp:200:72:200:73 | getInt16 output argument | +| bslx.cpp:200:71:200:75 | *call to getInt16 | bslx.cpp:200:85:200:89 | *call to getUint16 | +| bslx.cpp:200:71:200:75 | *call to getInt16 | bslx.cpp:200:86:200:87 | getUint16 output argument | +| bslx.cpp:200:85:200:89 | *call to getUint16 | bslx.cpp:200:98:200:102 | *call to getInt24 | +| bslx.cpp:200:85:200:89 | *call to getUint16 | bslx.cpp:200:99:200:100 | getInt24 output argument | +| bslx.cpp:200:98:200:102 | *call to getInt24 | bslx.cpp:200:112:200:116 | *call to getUint24 | +| bslx.cpp:200:98:200:102 | *call to getInt24 | bslx.cpp:200:113:200:114 | getUint24 output argument | +| bslx.cpp:200:112:200:116 | *call to getUint24 | bslx.cpp:200:125:200:129 | *call to getInt32 | +| bslx.cpp:200:112:200:116 | *call to getUint24 | bslx.cpp:200:126:200:127 | getInt32 output argument | +| bslx.cpp:200:125:200:129 | *call to getInt32 | bslx.cpp:200:139:200:143 | *call to getUint32 | +| bslx.cpp:200:125:200:129 | *call to getInt32 | bslx.cpp:200:140:200:141 | getUint32 output argument | +| bslx.cpp:200:139:200:143 | *call to getUint32 | bslx.cpp:200:152:200:156 | *call to getInt40 | +| bslx.cpp:200:139:200:143 | *call to getUint32 | bslx.cpp:200:153:200:154 | getInt40 output argument | +| bslx.cpp:200:152:200:156 | *call to getInt40 | bslx.cpp:200:166:200:170 | *call to getUint40 | +| bslx.cpp:200:152:200:156 | *call to getInt40 | bslx.cpp:200:167:200:168 | getUint40 output argument | +| bslx.cpp:200:166:200:170 | *call to getUint40 | bslx.cpp:200:179:200:183 | *call to getInt48 | +| bslx.cpp:200:166:200:170 | *call to getUint40 | bslx.cpp:200:180:200:181 | getInt48 output argument | +| bslx.cpp:200:179:200:183 | *call to getInt48 | bslx.cpp:200:193:200:197 | *call to getUint48 | +| bslx.cpp:200:179:200:183 | *call to getInt48 | bslx.cpp:200:194:200:195 | getUint48 output argument | +| bslx.cpp:200:193:200:197 | *call to getUint48 | bslx.cpp:200:206:200:210 | *call to getInt56 | +| bslx.cpp:200:193:200:197 | *call to getUint48 | bslx.cpp:200:207:200:208 | getInt56 output argument | +| bslx.cpp:200:206:200:210 | *call to getInt56 | bslx.cpp:200:220:200:224 | *call to getUint56 | +| bslx.cpp:200:206:200:210 | *call to getInt56 | bslx.cpp:200:221:200:222 | getUint56 output argument | +| bslx.cpp:200:220:200:224 | *call to getUint56 | bslx.cpp:200:233:200:237 | *call to getInt64 | +| bslx.cpp:200:220:200:224 | *call to getUint56 | bslx.cpp:200:234:200:235 | getInt64 output argument | +| bslx.cpp:200:233:200:237 | *call to getInt64 | bslx.cpp:200:247:200:251 | *call to getUint64 | +| bslx.cpp:200:233:200:237 | *call to getInt64 | bslx.cpp:200:248:200:249 | getUint64 output argument | +| bslx.cpp:200:247:200:251 | *call to getUint64 | bslx.cpp:200:262:200:266 | *call to getFloat32 | +| bslx.cpp:200:247:200:251 | *call to getUint64 | bslx.cpp:200:263:200:264 | getFloat32 output argument | +| bslx.cpp:200:262:200:266 | *call to getFloat32 | bslx.cpp:200:277:200:281 | *call to getFloat64 | +| bslx.cpp:200:262:200:266 | *call to getFloat32 | bslx.cpp:200:278:200:279 | getFloat64 output argument | +| bslx.cpp:200:277:200:281 | *call to getFloat64 | bslx.cpp:200:291:200:296 | *call to getString | +| bslx.cpp:200:277:200:281 | *call to getFloat64 | bslx.cpp:200:292:200:294 | getString output argument | +| bslx.cpp:200:291:200:296 | *call to getString | bslx.cpp:200:309:200:319 | *call to getArrayInt8 | +| bslx.cpp:200:291:200:296 | *call to getString | bslx.cpp:200:310:200:313 | getArrayInt8 output argument | +| bslx.cpp:200:309:200:319 | *call to getArrayInt8 | bslx.cpp:200:333:200:343 | *call to getArrayUint8 | +| bslx.cpp:200:309:200:319 | *call to getArrayInt8 | bslx.cpp:200:334:200:337 | getArrayUint8 output argument | +| bslx.cpp:200:333:200:343 | *call to getArrayUint8 | bslx.cpp:200:357:200:367 | *call to getArrayInt16 | +| bslx.cpp:200:333:200:343 | *call to getArrayUint8 | bslx.cpp:200:358:200:361 | getArrayInt16 output argument | +| bslx.cpp:200:357:200:367 | *call to getArrayInt16 | bslx.cpp:200:382:200:392 | *call to getArrayUint16 | +| bslx.cpp:200:357:200:367 | *call to getArrayInt16 | bslx.cpp:200:383:200:386 | getArrayUint16 output argument | +| bslx.cpp:200:382:200:392 | *call to getArrayUint16 | bslx.cpp:200:406:200:416 | *call to getArrayInt24 | +| bslx.cpp:200:382:200:392 | *call to getArrayUint16 | bslx.cpp:200:407:200:410 | getArrayInt24 output argument | +| bslx.cpp:200:406:200:416 | *call to getArrayInt24 | bslx.cpp:200:431:200:441 | *call to getArrayUint24 | +| bslx.cpp:200:406:200:416 | *call to getArrayInt24 | bslx.cpp:200:432:200:435 | getArrayUint24 output argument | +| bslx.cpp:200:431:200:441 | *call to getArrayUint24 | bslx.cpp:200:455:200:465 | *call to getArrayInt32 | +| bslx.cpp:200:431:200:441 | *call to getArrayUint24 | bslx.cpp:200:456:200:459 | getArrayInt32 output argument | +| bslx.cpp:200:455:200:465 | *call to getArrayInt32 | bslx.cpp:200:480:200:490 | *call to getArrayUint32 | +| bslx.cpp:200:455:200:465 | *call to getArrayInt32 | bslx.cpp:200:481:200:484 | getArrayUint32 output argument | +| bslx.cpp:200:480:200:490 | *call to getArrayUint32 | bslx.cpp:200:504:200:514 | *call to getArrayInt40 | +| bslx.cpp:200:480:200:490 | *call to getArrayUint32 | bslx.cpp:200:505:200:508 | getArrayInt40 output argument | +| bslx.cpp:200:504:200:514 | *call to getArrayInt40 | bslx.cpp:200:529:200:539 | *call to getArrayUint40 | +| bslx.cpp:200:504:200:514 | *call to getArrayInt40 | bslx.cpp:200:530:200:533 | getArrayUint40 output argument | +| bslx.cpp:200:529:200:539 | *call to getArrayUint40 | bslx.cpp:200:553:200:563 | *call to getArrayInt48 | +| bslx.cpp:200:529:200:539 | *call to getArrayUint40 | bslx.cpp:200:554:200:557 | getArrayInt48 output argument | +| bslx.cpp:200:553:200:563 | *call to getArrayInt48 | bslx.cpp:200:578:200:588 | *call to getArrayUint48 | +| bslx.cpp:200:553:200:563 | *call to getArrayInt48 | bslx.cpp:200:579:200:582 | getArrayUint48 output argument | +| bslx.cpp:200:578:200:588 | *call to getArrayUint48 | bslx.cpp:200:602:200:612 | *call to getArrayInt56 | +| bslx.cpp:200:578:200:588 | *call to getArrayUint48 | bslx.cpp:200:603:200:606 | getArrayInt56 output argument | +| bslx.cpp:200:602:200:612 | *call to getArrayInt56 | bslx.cpp:200:627:200:637 | *call to getArrayUint56 | +| bslx.cpp:200:602:200:612 | *call to getArrayInt56 | bslx.cpp:200:628:200:631 | getArrayUint56 output argument | +| bslx.cpp:200:627:200:637 | *call to getArrayUint56 | bslx.cpp:200:651:200:661 | *call to getArrayInt64 | +| bslx.cpp:200:627:200:637 | *call to getArrayUint56 | bslx.cpp:200:652:200:655 | getArrayInt64 output argument | +| bslx.cpp:200:651:200:661 | *call to getArrayInt64 | bslx.cpp:200:676:200:686 | *call to getArrayUint64 | +| bslx.cpp:200:651:200:661 | *call to getArrayInt64 | bslx.cpp:200:677:200:680 | getArrayUint64 output argument | +| bslx.cpp:200:676:200:686 | *call to getArrayUint64 | bslx.cpp:200:702:200:712 | *call to getArrayFloat32 | +| bslx.cpp:200:676:200:686 | *call to getArrayUint64 | bslx.cpp:200:703:200:706 | getArrayFloat32 output argument | +| bslx.cpp:200:702:200:712 | *call to getArrayFloat32 | bslx.cpp:200:728:200:738 | *call to getArrayFloat64 | +| bslx.cpp:200:702:200:712 | *call to getArrayFloat32 | bslx.cpp:200:729:200:732 | getArrayFloat64 output argument | | test.cpp:17:24:17:24 | x | test.cpp:17:10:17:22 | call to ymlStepManual | | test.cpp:21:27:21:27 | x | test.cpp:21:10:21:25 | call to ymlStepGenerated | | test.cpp:25:35:25:35 | x | test.cpp:25:11:25:33 | call to ymlStepManual_with_body |