joern
joern copied to clipboard
[Bug][C] Data flow issue with global variables modified in method calls
Describe the bug
reachableByFlows appears to struggle with global variables that are modified in other functions.
To Reproduce
#include <stdio.h>
int x;
int y = 1337;
void set_x() {
x = y;
}
int main (int argc, char **argv) {
set_x();
int z = x;
}
// in joern, after importCode():
cpg.identifier("z").reachableByFlows(cpg.identifier("x")).p // found
cpg.identifier("z").reachableByFlows(cpg.identifier("y")).p // empty
Expected behavior The data flow from y to z should be found (last line).
Desktop (please complete the following information): Latest joern via docker/nightly (4.0.388)
This is a known limitation of Joern's dataflow engine (also manifests with flows in and out of lambdas / anonymous function in all supported languages at the moment. I am not sure if someone works on that at the moment or what the plans are to support this in the future.