C++: Add a few more models I noticed while here.

Author: How To Reshare A Story On Instagram

cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll

@@ -12,8 +12,8 @@ import semmle.code.cpp.models.interfaces.Taint
 import semmle.code.cpp.models.interfaces.NonThrowing
 
 /**
- * The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant
- * `__builtin___memcpy_chk`.
+ * The standard functions `memcpy`, `memmove` and `bcopy`; and variants such as
+ * `__builtin___memcpy_chk` and `__builtin___memmove_chk`.
  */
 private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction,
  AliasFunction, NonCppThrowingFunction
@@ -27,7 +27,9 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect
  // bcopy(src, dest, num)
  // mempcpy(dest, src, num)
  // memccpy(dest, src, c, n)
- this.hasGlobalName(["bcopy", mempcpy(), "memccpy", "__builtin___memcpy_chk"])
+ this.hasGlobalName([
+ "bcopy", mempcpy(), "memccpy", "__builtin___memcpy_chk", "__builtin___memmove_chk"
+ ])
  }
 
  /**

cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll

@@ -19,7 +19,8 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
  this.hasGlobalOrStdName("wmemset")
  or
  this.hasGlobalName([
- bzero(), "__builtin_memset", "__builtin_memset_chk", "RtlZeroMemory", "RtlSecureZeroMemory"
+ bzero(), "__builtin_memset", "__builtin_memset_chk", "__builtin___memset_chk",
+ "RtlZeroMemory", "RtlSecureZeroMemory"
  ])
  }
 
@@ -32,7 +33,7 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias
  or
  this.hasGlobalOrStdName("wmemset")
  or
- this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk"])
+ this.hasGlobalName(["__builtin_memset", "__builtin_memset_chk", "__builtin___memset_chk"])
  ) and
  result = 1
  }

cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll

@@ -30,7 +30,9 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
  "_mbsncat", // _mbsncat(dst, src, max_amount)
  "_mbsncat_l", // _mbsncat_l(dst, src, max_amount, locale)
  "_mbsnbcat", // _mbsnbcat(dest, src, count)
- "_mbsnbcat_l" // _mbsnbcat_l(dest, src, count, locale)
+ "_mbsnbcat_l", // _mbsnbcat_l(dest, src, count, locale)
+ "__builtin___strcat_chk", // __builtin___strcat_chk (dest, src, magic);
+ "__builtin___strncat_chk" // __builtin___strncat_chk (dest, src, max_amount, magic);
  ])
  }
 
@@ -56,7 +58,11 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid
 
  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
  (
- this.getName() = ["strncat", "wcsncat", "_mbsncat", "_mbsncat_l"] and
+ this.getName() =
+ [
+ "strncat", "wcsncat", "_mbsncat", "_mbsncat_l", "__builtin___strncat_chk",
+ "__builtin___strcat_chk"
+ ] and
  input.isParameter(2)
  or
  this.getName() = ["_mbsncat_l", "_mbsnbcat_l"] and

cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll

@@ -36,7 +36,11 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
  "_mbsnbcpy", // _mbsnbcpy(dest, src, max_amount)
  "stpcpy", // stpcpy(dest, src)
  "stpncpy", // stpncpy(dest, src, max_amount)
- "strlcpy" // strlcpy(dst, src, dst_size)
+ "strlcpy", // strlcpy(dst, src, dst_size)
+ "__builtin___strcpy_chk", // __builtin___strcpy_chk (dest, src, magic);
+ "__builtin___stpcpy_chk", // __builtin___stpcpy_chk (dest, src, magic);
+ "__builtin___stpncpy_chk", // __builtin___stpncpy_chk(dest, src, max_amount, magic)
+ "__builtin___strncpy_chk" // __builtin___strncpy_chk (dest, src, max_amount, magic);
  ])
  or
  (
@@ -69,7 +73,11 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid
  if this.isSVariant()
  then result = 1
  else (
- this.getName().matches(["%ncpy%", "%nbcpy%", "%xfrm%", "strlcpy"]) and
+ this.getName()
+ .matches([
+ "%ncpy%", "%nbcpy%", "%xfrm%", "strlcpy", "__builtin___strcpy_chk",
+ "__builtin___stpcpy_chk", "__builtin___stpncpy_chk", "__builtin___strncpy_chk"
+ ]) and
  result = 2
  )
  }