Skip to content

Commit 533e1d8

Browse files
MathiasVPMathiasVP
committed
C++: Add some use-after-free FPs.
1 parent 7285704 commit 533e1d8

File tree

3 files changed

+62
-0
lines changed

3 files changed

+62
-0
lines changed

‎cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryFreed.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@
8989
| test_free.cpp:216:10:216:10 | a |
9090
| test_free.cpp:220:10:220:10 | a |
9191
| test_free.cpp:227:24:227:45 | memory_descriptor_list |
92+
| test_free.cpp:233:14:233:15 | * ... |
93+
| test_free.cpp:239:14:239:15 | * ... |
94+
| test_free.cpp:245:10:245:11 | * ... |
9295
| virtual.cpp:18:10:18:10 | a |
9396
| virtual.cpp:19:10:19:10 | c |
9497
| virtual.cpp:38:10:38:10 | b |

‎cpp/ql/test/query-tests/Critical/MemoryFreed/UseAfterFree.expected

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,20 @@ edges
1515
| test_free.cpp:101:10:101:10 | a | test_free.cpp:102:23:102:23 | a |
1616
| test_free.cpp:152:27:152:27 | a | test_free.cpp:153:5:153:5 | a |
1717
| test_free.cpp:152:27:152:27 | a | test_free.cpp:153:5:153:5 | a |
18+
| test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
19+
| test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
20+
| test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
21+
| test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
22+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
23+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
24+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
25+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
26+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:10:241:10 | b |
27+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:10:241:10 | b |
28+
| test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
29+
| test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
30+
| test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
31+
| test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
1832
nodes
1933
| test_free.cpp:11:10:11:10 | a | semmle.label | a |
2034
| test_free.cpp:11:10:11:10 | a | semmle.label | a |
@@ -39,6 +53,19 @@ nodes
3953
| test_free.cpp:152:27:152:27 | a | semmle.label | a |
4054
| test_free.cpp:152:27:152:27 | a | semmle.label | a |
4155
| test_free.cpp:153:5:153:5 | a | semmle.label | a |
56+
| test_free.cpp:233:14:233:15 | * ... | semmle.label | * ... |
57+
| test_free.cpp:233:14:233:15 | * ... | semmle.label | * ... |
58+
| test_free.cpp:236:9:236:10 | * ... | semmle.label | * ... |
59+
| test_free.cpp:236:9:236:10 | * ... | semmle.label | * ... |
60+
| test_free.cpp:239:14:239:15 | * ... | semmle.label | * ... |
61+
| test_free.cpp:239:14:239:15 | * ... | semmle.label | * ... |
62+
| test_free.cpp:241:9:241:10 | * ... | semmle.label | * ... |
63+
| test_free.cpp:241:9:241:10 | * ... | semmle.label | * ... |
64+
| test_free.cpp:241:10:241:10 | b | semmle.label | b |
65+
| test_free.cpp:245:10:245:11 | * ... | semmle.label | * ... |
66+
| test_free.cpp:245:10:245:11 | * ... | semmle.label | * ... |
67+
| test_free.cpp:246:9:246:10 | * ... | semmle.label | * ... |
68+
| test_free.cpp:246:9:246:10 | * ... | semmle.label | * ... |
4269
subpaths
4370
#select
4471
| test_free.cpp:12:5:12:5 | a | test_free.cpp:11:10:11:10 | a | test_free.cpp:12:5:12:5 | a | Memory may have been previously freed by $@. | test_free.cpp:11:5:11:8 | call to free | call to free |
@@ -57,3 +84,17 @@ subpaths
5784
| test_free.cpp:102:23:102:23 | a | test_free.cpp:101:10:101:10 | a | test_free.cpp:102:23:102:23 | a | Memory may have been previously freed by $@. | test_free.cpp:101:5:101:8 | call to free | call to free |
5885
| test_free.cpp:153:5:153:5 | a | test_free.cpp:152:27:152:27 | a | test_free.cpp:153:5:153:5 | a | Memory may have been previously freed by $@. | test_free.cpp:152:22:152:25 | call to free | call to free |
5986
| test_free.cpp:153:5:153:5 | a | test_free.cpp:152:27:152:27 | a | test_free.cpp:153:5:153:5 | a | Memory may have been previously freed by $@. | test_free.cpp:152:22:152:25 | call to free | call to free |
87+
| test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
88+
| test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
89+
| test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
90+
| test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
91+
| test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
92+
| test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
93+
| test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
94+
| test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
95+
| test_free.cpp:241:10:241:10 | b | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:10:241:10 | b | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
96+
| test_free.cpp:241:10:241:10 | b | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:10:241:10 | b | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
97+
| test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |
98+
| test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |
99+
| test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |
100+
| test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |

‎cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,3 +227,21 @@ void test_ms_free(void * memory_descriptor_list) {
227227
MmFreePagesFromMdl(memory_descriptor_list); //GOOD
228228
ExFreePool(memory_descriptor_list); // GOOD
229229
}
230+
231+
void test_loop3(char ** a, char ** b) {
232+
if (*a) {
233+
free(*a);
234+
a++;
235+
}
236+
use(*a); // GOOD [FALSE POSITIVE]
237+
238+
for (;*b; b++) {
239+
free(*b);
240+
}
241+
use(*b); // GOOD [FALSE POSITIVE]
242+
}
243+
244+
void test_deref(char **a) {
245+
free(*a);
246+
use(*a); // GOOD [FALSE POSITIVE]
247+
}

0 commit comments

Comments
 (0)