[C] struct's fields fine grained taint analysis

[vaioco]

Hi *,
Given the following C code I want to apply struct's fields taint tracking in a fine-grained approach.

void f(){
    struct1_t s;
    source(&s.len);
    sink(s.param); //<---- false positive
    sink(s.len); // <------ TP
}

I wrote the following query to propagate taint to struct's fields access.

exists(AddresOfExpr a1, FieldAccess fa, Field f |
    a1.getOperand()
        .(FieldAccess)
        .getQualifier()
        .(VariableAccess)
        .getTarget = fa.getQualifier.(VariableAccess).getTarget()
    and node1.asDefinitionArgument() = a1
    and node2.asExpr() = fa
    and fa.getTarget() = f
    and a1.getOperand().(FieldAccess).getTarget() = f
)

The above predicate is used in isAdditionalTaintStep(). The query above seems working as expected, the expression sink(s.len) was found while sink(s.param) wasn't.

Do you have any suggestions about how to possibly improve the above query or to rewrite it by using SSA form?

thanks

[jbj]

Flow through fields is one of the main things we're working to improve right now. Ideally your example should already work with either our current data-flow library (import semmle.code.cpp.dataflow.TaintTracking) or the replacement we're developing (import semmle.code.cpp.ir.dataflow.TaintTracking). Have you tried both?