Skip to content

Commit 205bb76

Browse files
MathiasVPMathiasVP
authored
Merge pull request github#12960 from MathiasVP/fp-invalid-deref-2
C++: Add more FPs for `cpp/invalid-pointer-deref`
2 parents ce64408 + 4ef58cd commit 205bb76

File tree

2 files changed

+158
-0
lines changed

2 files changed

+158
-0
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -586,6 +586,118 @@ edges
586586
| test.cpp:248:24:248:30 | call to realloc | test.cpp:254:9:254:9 | p |
587587
| test.cpp:254:9:254:9 | p | test.cpp:254:9:254:12 | access to array |
588588
| test.cpp:254:9:254:12 | access to array | test.cpp:254:9:254:16 | Store: ... = ... |
589+
| test.cpp:260:13:260:24 | new[] | test.cpp:261:14:261:15 | xs |
590+
| test.cpp:261:14:261:15 | xs | test.cpp:261:14:261:21 | ... + ... |
591+
| test.cpp:261:14:261:15 | xs | test.cpp:261:14:261:21 | ... + ... |
592+
| test.cpp:261:14:261:15 | xs | test.cpp:261:14:261:21 | ... + ... |
593+
| test.cpp:261:14:261:15 | xs | test.cpp:261:14:261:21 | ... + ... |
594+
| test.cpp:261:14:261:15 | xs | test.cpp:262:26:262:28 | end |
595+
| test.cpp:261:14:261:15 | xs | test.cpp:262:26:262:28 | end |
596+
| test.cpp:261:14:261:15 | xs | test.cpp:262:31:262:31 | x |
597+
| test.cpp:261:14:261:15 | xs | test.cpp:262:31:262:33 | ... ++ |
598+
| test.cpp:261:14:261:15 | xs | test.cpp:262:31:262:33 | ... ++ |
599+
| test.cpp:261:14:261:15 | xs | test.cpp:264:14:264:14 | x |
600+
| test.cpp:261:14:261:15 | xs | test.cpp:264:14:264:14 | x |
601+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:261:14:261:21 | ... + ... |
602+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:261:14:261:21 | ... + ... |
603+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:262:26:262:28 | end |
604+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:262:26:262:28 | end |
605+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:262:26:262:28 | end |
606+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:262:26:262:28 | end |
607+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:264:13:264:14 | Load: * ... |
608+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:264:13:264:14 | Load: * ... |
609+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:264:13:264:14 | Load: * ... |
610+
| test.cpp:261:14:261:21 | ... + ... | test.cpp:264:13:264:14 | Load: * ... |
611+
| test.cpp:262:21:262:21 | x | test.cpp:264:13:264:14 | Load: * ... |
612+
| test.cpp:262:26:262:28 | end | test.cpp:262:26:262:28 | end |
613+
| test.cpp:262:26:262:28 | end | test.cpp:262:26:262:28 | end |
614+
| test.cpp:262:26:262:28 | end | test.cpp:264:13:264:14 | Load: * ... |
615+
| test.cpp:262:26:262:28 | end | test.cpp:264:13:264:14 | Load: * ... |
616+
| test.cpp:262:31:262:31 | x | test.cpp:264:13:264:14 | Load: * ... |
617+
| test.cpp:262:31:262:33 | ... ++ | test.cpp:262:21:262:21 | x |
618+
| test.cpp:262:31:262:33 | ... ++ | test.cpp:262:21:262:21 | x |
619+
| test.cpp:262:31:262:33 | ... ++ | test.cpp:262:31:262:31 | x |
620+
| test.cpp:262:31:262:33 | ... ++ | test.cpp:262:31:262:31 | x |
621+
| test.cpp:262:31:262:33 | ... ++ | test.cpp:264:14:264:14 | x |
622+
| test.cpp:262:31:262:33 | ... ++ | test.cpp:264:14:264:14 | x |
623+
| test.cpp:262:31:262:33 | ... ++ | test.cpp:264:14:264:14 | x |
624+
| test.cpp:262:31:262:33 | ... ++ | test.cpp:264:14:264:14 | x |
625+
| test.cpp:264:14:264:14 | x | test.cpp:262:31:262:31 | x |
626+
| test.cpp:264:14:264:14 | x | test.cpp:264:13:264:14 | Load: * ... |
627+
| test.cpp:264:14:264:14 | x | test.cpp:264:13:264:14 | Load: * ... |
628+
| test.cpp:270:13:270:24 | new[] | test.cpp:271:14:271:15 | xs |
629+
| test.cpp:270:13:270:24 | new[] | test.cpp:272:31:272:31 | x |
630+
| test.cpp:271:14:271:15 | xs | test.cpp:271:14:271:21 | ... + ... |
631+
| test.cpp:271:14:271:15 | xs | test.cpp:271:14:271:21 | ... + ... |
632+
| test.cpp:271:14:271:15 | xs | test.cpp:271:14:271:21 | ... + ... |
633+
| test.cpp:271:14:271:15 | xs | test.cpp:271:14:271:21 | ... + ... |
634+
| test.cpp:271:14:271:15 | xs | test.cpp:272:26:272:28 | end |
635+
| test.cpp:271:14:271:15 | xs | test.cpp:272:26:272:28 | end |
636+
| test.cpp:271:14:271:15 | xs | test.cpp:272:31:272:31 | x |
637+
| test.cpp:271:14:271:15 | xs | test.cpp:272:31:272:33 | ... ++ |
638+
| test.cpp:271:14:271:15 | xs | test.cpp:272:31:272:33 | ... ++ |
639+
| test.cpp:271:14:271:15 | xs | test.cpp:274:5:274:6 | * ... |
640+
| test.cpp:271:14:271:15 | xs | test.cpp:274:6:274:6 | x |
641+
| test.cpp:271:14:271:15 | xs | test.cpp:274:6:274:6 | x |
642+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:271:14:271:21 | ... + ... |
643+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:271:14:271:21 | ... + ... |
644+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:272:26:272:28 | end |
645+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:272:26:272:28 | end |
646+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:272:26:272:28 | end |
647+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:272:26:272:28 | end |
648+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:274:5:274:10 | Store: ... = ... |
649+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:274:5:274:10 | Store: ... = ... |
650+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:274:5:274:10 | Store: ... = ... |
651+
| test.cpp:271:14:271:21 | ... + ... | test.cpp:274:5:274:10 | Store: ... = ... |
652+
| test.cpp:272:21:272:21 | x | test.cpp:274:5:274:10 | Store: ... = ... |
653+
| test.cpp:272:26:272:28 | end | test.cpp:272:26:272:28 | end |
654+
| test.cpp:272:26:272:28 | end | test.cpp:272:26:272:28 | end |
655+
| test.cpp:272:26:272:28 | end | test.cpp:274:5:274:10 | Store: ... = ... |
656+
| test.cpp:272:26:272:28 | end | test.cpp:274:5:274:10 | Store: ... = ... |
657+
| test.cpp:272:31:272:31 | x | test.cpp:274:5:274:10 | Store: ... = ... |
658+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:272:21:272:21 | x |
659+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:272:21:272:21 | x |
660+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:272:31:272:31 | x |
661+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:272:31:272:31 | x |
662+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:274:5:274:6 | * ... |
663+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:274:5:274:6 | * ... |
664+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:274:6:274:6 | x |
665+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:274:6:274:6 | x |
666+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:274:6:274:6 | x |
667+
| test.cpp:272:31:272:33 | ... ++ | test.cpp:274:6:274:6 | x |
668+
| test.cpp:274:5:274:6 | * ... | test.cpp:274:5:274:10 | Store: ... = ... |
669+
| test.cpp:274:6:274:6 | x | test.cpp:272:31:272:31 | x |
670+
| test.cpp:274:6:274:6 | x | test.cpp:274:5:274:6 | * ... |
671+
| test.cpp:274:6:274:6 | x | test.cpp:274:5:274:10 | Store: ... = ... |
672+
| test.cpp:274:6:274:6 | x | test.cpp:274:5:274:10 | Store: ... = ... |
673+
| test.cpp:280:13:280:24 | new[] | test.cpp:281:14:281:15 | xs |
674+
| test.cpp:281:14:281:15 | xs | test.cpp:282:30:282:32 | ... ++ |
675+
| test.cpp:281:14:281:15 | xs | test.cpp:282:30:282:32 | ... ++ |
676+
| test.cpp:282:21:282:21 | x | test.cpp:284:13:284:14 | Load: * ... |
677+
| test.cpp:282:30:282:30 | x | test.cpp:284:13:284:14 | Load: * ... |
678+
| test.cpp:282:30:282:32 | ... ++ | test.cpp:282:21:282:21 | x |
679+
| test.cpp:282:30:282:32 | ... ++ | test.cpp:282:21:282:21 | x |
680+
| test.cpp:282:30:282:32 | ... ++ | test.cpp:282:30:282:30 | x |
681+
| test.cpp:282:30:282:32 | ... ++ | test.cpp:282:30:282:30 | x |
682+
| test.cpp:282:30:282:32 | ... ++ | test.cpp:284:14:284:14 | x |
683+
| test.cpp:282:30:282:32 | ... ++ | test.cpp:284:14:284:14 | x |
684+
| test.cpp:284:14:284:14 | x | test.cpp:284:13:284:14 | Load: * ... |
685+
| test.cpp:290:13:290:24 | new[] | test.cpp:291:14:291:15 | xs |
686+
| test.cpp:290:13:290:24 | new[] | test.cpp:292:30:292:30 | x |
687+
| test.cpp:291:14:291:15 | xs | test.cpp:292:30:292:32 | ... ++ |
688+
| test.cpp:291:14:291:15 | xs | test.cpp:292:30:292:32 | ... ++ |
689+
| test.cpp:292:21:292:21 | x | test.cpp:294:5:294:10 | Store: ... = ... |
690+
| test.cpp:292:30:292:30 | x | test.cpp:294:5:294:10 | Store: ... = ... |
691+
| test.cpp:292:30:292:32 | ... ++ | test.cpp:292:21:292:21 | x |
692+
| test.cpp:292:30:292:32 | ... ++ | test.cpp:292:21:292:21 | x |
693+
| test.cpp:292:30:292:32 | ... ++ | test.cpp:292:30:292:30 | x |
694+
| test.cpp:292:30:292:32 | ... ++ | test.cpp:292:30:292:30 | x |
695+
| test.cpp:292:30:292:32 | ... ++ | test.cpp:294:5:294:6 | * ... |
696+
| test.cpp:292:30:292:32 | ... ++ | test.cpp:294:5:294:6 | * ... |
697+
| test.cpp:292:30:292:32 | ... ++ | test.cpp:294:6:294:6 | x |
698+
| test.cpp:292:30:292:32 | ... ++ | test.cpp:294:6:294:6 | x |
699+
| test.cpp:294:5:294:6 | * ... | test.cpp:294:5:294:10 | Store: ... = ... |
700+
| test.cpp:294:6:294:6 | x | test.cpp:294:5:294:10 | Store: ... = ... |
589701
#select
590702
| test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
591703
| test.cpp:8:14:8:21 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:8:14:8:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -607,3 +719,9 @@ edges
607719
| test.cpp:232:3:232:20 | Store: ... = ... | test.cpp:231:18:231:30 | new[] | test.cpp:232:3:232:20 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:231:18:231:30 | new[] | new[] | test.cpp:232:11:232:15 | index | index |
608720
| test.cpp:239:5:239:22 | Store: ... = ... | test.cpp:238:20:238:32 | new[] | test.cpp:239:5:239:22 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:238:20:238:32 | new[] | new[] | test.cpp:239:13:239:17 | index | index |
609721
| test.cpp:254:9:254:16 | Store: ... = ... | test.cpp:248:24:248:30 | call to realloc | test.cpp:254:9:254:16 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:248:24:248:30 | call to realloc | call to realloc | test.cpp:254:11:254:11 | i | i |
722+
| test.cpp:264:13:264:14 | Load: * ... | test.cpp:260:13:260:24 | new[] | test.cpp:264:13:264:14 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:260:13:260:24 | new[] | new[] | test.cpp:261:19:261:21 | len | len |
723+
| test.cpp:264:13:264:14 | Load: * ... | test.cpp:260:13:260:24 | new[] | test.cpp:264:13:264:14 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:260:13:260:24 | new[] | new[] | test.cpp:261:19:261:21 | len | len |
724+
| test.cpp:274:5:274:10 | Store: ... = ... | test.cpp:270:13:270:24 | new[] | test.cpp:274:5:274:10 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:270:13:270:24 | new[] | new[] | test.cpp:271:19:271:21 | len | len |
725+
| test.cpp:274:5:274:10 | Store: ... = ... | test.cpp:270:13:270:24 | new[] | test.cpp:274:5:274:10 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:270:13:270:24 | new[] | new[] | test.cpp:271:19:271:21 | len | len |
726+
| test.cpp:284:13:284:14 | Load: * ... | test.cpp:280:13:280:24 | new[] | test.cpp:284:13:284:14 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:280:13:280:24 | new[] | new[] | test.cpp:281:19:281:21 | len | len |
727+
| test.cpp:294:5:294:10 | Store: ... = ... | test.cpp:290:13:290:24 | new[] | test.cpp:294:5:294:10 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:290:13:290:24 | new[] | new[] | test.cpp:291:19:291:21 | len | len |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,3 +254,43 @@ void test17(unsigned *p, unsigned x, unsigned k) {
254254
p[i] = x; // GOOD [FALSE POSITIVE]
255255
}
256256
}
257+
258+
void test17(unsigned len)
259+
{
260+
int *xs = new int[len];
261+
int *end = xs + len;
262+
for (int *x = xs; x <= end; x++)
263+
{
264+
int i = *x; // BAD
265+
}
266+
}
267+
268+
void test18(unsigned len)
269+
{
270+
int *xs = new int[len];
271+
int *end = xs + len;
272+
for (int *x = xs; x <= end; x++)
273+
{
274+
*x = 0; // BAD
275+
}
276+
}
277+
278+
void test19(unsigned len)
279+
{
280+
int *xs = new int[len];
281+
int *end = xs + len;
282+
for (int *x = xs; x < end; x++)
283+
{
284+
int i = *x; // GOOD [FALSE POSITIVE]
285+
}
286+
}
287+
288+
void test20(unsigned len)
289+
{
290+
int *xs = new int[len];
291+
int *end = xs + len;
292+
for (int *x = xs; x < end; x++)
293+
{
294+
*x = 0; // GOOD [FALSE POSITIVE]
295+
}
296+
}

0 commit comments

Comments
 (0)