NFS: order source before sink

jbj · jbj · commit 868da83065b0 · 2019-02-28T11:23:03.000+01:00
diff --git a/ql_demos/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/BCopyNegativeSize.ql b/ql_demos/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/BCopyNegativeSize.ql
@@ -17,16 +17,16 @@ class MyCfg extends TaintTracking::Configuration {
     this = "MyCfg"
   }
 
+  override predicate isSource(DataFlow::Node source) {
+    source.asExpr().(FunctionCall).getTarget().getName() = "mbuf_data"
+  }
+
   override predicate isSink(DataFlow::Node sink) {
     exists (FunctionCall call
     | sink.asExpr() = call.getArgument(2) and
       call.getTarget().getName() = "__builtin___memmove_chk" and
       lowerBound(sink.asExpr()) < 0)
   }
-
-  override predicate isSource(DataFlow::Node source) {
-    source.asExpr().(FunctionCall).getTarget().getName() = "mbuf_data"
-  }
 }
 
 from DataFlow::PathNode sink, DataFlow::PathNode source, MyCfg cfg

Original file line number	Diff line number	Diff line change
`@@ -17,16 +17,16 @@ class MyCfg extends TaintTracking::Configuration {`
`17`	`17`	`this = "MyCfg"`
`18`	`18`	`}`
`19`	`19`
	`20`	`+ override predicate isSource(DataFlow::Node source) {`
	`21`	`+ source.asExpr().(FunctionCall).getTarget().getName() = "mbuf_data"`
	`22`	`+ }`
	`23`	`+`
`20`	`24`	`override predicate isSink(DataFlow::Node sink) {`
`21`	`25`	`exists (FunctionCall call`
`22`	`26`	`\| sink.asExpr() = call.getArgument(2) and`
`23`	`27`	`call.getTarget().getName() = "__builtin___memmove_chk" and`
`24`	`28`	`lowerBound(sink.asExpr()) < 0)`
`25`	`29`	`}`
`26`		`-`
`27`		`- override predicate isSource(DataFlow::Node source) {`
`28`		`- source.asExpr().(FunctionCall).getTarget().getName() = "mbuf_data"`
`29`		`- }`
`30`	`30`	`}`
`31`	`31`
`32`	`32`	`from DataFlow::PathNode sink, DataFlow::PathNode source, MyCfg cfg`