Skip to content

Commit 5c23474

Browse files
MathiasVPMathiasVP
committed
C++: Add FPs for 'cpp/invalid-pointer-deref'.
1 parent 6c095d8 commit 5c23474

File tree

2 files changed

+164
-0
lines changed

2 files changed

+164
-0
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -586,6 +586,118 @@ edges
586586
| test.cpp:248:24:248:30 | call to realloc | test.cpp:254:9:254:9 | p |
587587
| test.cpp:254:9:254:9 | p | test.cpp:254:9:254:12 | access to array |
588588
| test.cpp:254:9:254:12 | access to array | test.cpp:254:9:254:16 | Store: ... = ... |
589+
| test.cpp:266:13:266:24 | new[] | test.cpp:267:14:267:15 | xs |
590+
| test.cpp:267:14:267:15 | xs | test.cpp:267:14:267:21 | ... + ... |
591+
| test.cpp:267:14:267:15 | xs | test.cpp:267:14:267:21 | ... + ... |
592+
| test.cpp:267:14:267:15 | xs | test.cpp:267:14:267:21 | ... + ... |
593+
| test.cpp:267:14:267:15 | xs | test.cpp:267:14:267:21 | ... + ... |
594+
| test.cpp:267:14:267:15 | xs | test.cpp:268:26:268:28 | end |
595+
| test.cpp:267:14:267:15 | xs | test.cpp:268:26:268:28 | end |
596+
| test.cpp:267:14:267:15 | xs | test.cpp:268:31:268:31 | x |
597+
| test.cpp:267:14:267:15 | xs | test.cpp:268:31:268:33 | ... ++ |
598+
| test.cpp:267:14:267:15 | xs | test.cpp:268:31:268:33 | ... ++ |
599+
| test.cpp:267:14:267:15 | xs | test.cpp:270:14:270:14 | x |
600+
| test.cpp:267:14:267:15 | xs | test.cpp:270:14:270:14 | x |
601+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:267:14:267:21 | ... + ... |
602+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:267:14:267:21 | ... + ... |
603+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:268:26:268:28 | end |
604+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:268:26:268:28 | end |
605+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:268:26:268:28 | end |
606+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:268:26:268:28 | end |
607+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:270:13:270:14 | Load: * ... |
608+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:270:13:270:14 | Load: * ... |
609+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:270:13:270:14 | Load: * ... |
610+
| test.cpp:267:14:267:21 | ... + ... | test.cpp:270:13:270:14 | Load: * ... |
611+
| test.cpp:268:21:268:21 | x | test.cpp:270:13:270:14 | Load: * ... |
612+
| test.cpp:268:26:268:28 | end | test.cpp:268:26:268:28 | end |
613+
| test.cpp:268:26:268:28 | end | test.cpp:268:26:268:28 | end |
614+
| test.cpp:268:26:268:28 | end | test.cpp:270:13:270:14 | Load: * ... |
615+
| test.cpp:268:26:268:28 | end | test.cpp:270:13:270:14 | Load: * ... |
616+
| test.cpp:268:31:268:31 | x | test.cpp:270:13:270:14 | Load: * ... |
617+
| test.cpp:268:31:268:33 | ... ++ | test.cpp:268:21:268:21 | x |
618+
| test.cpp:268:31:268:33 | ... ++ | test.cpp:268:21:268:21 | x |
619+
| test.cpp:268:31:268:33 | ... ++ | test.cpp:268:31:268:31 | x |
620+
| test.cpp:268:31:268:33 | ... ++ | test.cpp:268:31:268:31 | x |
621+
| test.cpp:268:31:268:33 | ... ++ | test.cpp:270:14:270:14 | x |
622+
| test.cpp:268:31:268:33 | ... ++ | test.cpp:270:14:270:14 | x |
623+
| test.cpp:268:31:268:33 | ... ++ | test.cpp:270:14:270:14 | x |
624+
| test.cpp:268:31:268:33 | ... ++ | test.cpp:270:14:270:14 | x |
625+
| test.cpp:270:14:270:14 | x | test.cpp:268:31:268:31 | x |
626+
| test.cpp:270:14:270:14 | x | test.cpp:270:13:270:14 | Load: * ... |
627+
| test.cpp:270:14:270:14 | x | test.cpp:270:13:270:14 | Load: * ... |
628+
| test.cpp:276:13:276:24 | new[] | test.cpp:277:14:277:15 | xs |
629+
| test.cpp:276:13:276:24 | new[] | test.cpp:278:31:278:31 | x |
630+
| test.cpp:277:14:277:15 | xs | test.cpp:277:14:277:21 | ... + ... |
631+
| test.cpp:277:14:277:15 | xs | test.cpp:277:14:277:21 | ... + ... |
632+
| test.cpp:277:14:277:15 | xs | test.cpp:277:14:277:21 | ... + ... |
633+
| test.cpp:277:14:277:15 | xs | test.cpp:277:14:277:21 | ... + ... |
634+
| test.cpp:277:14:277:15 | xs | test.cpp:278:26:278:28 | end |
635+
| test.cpp:277:14:277:15 | xs | test.cpp:278:26:278:28 | end |
636+
| test.cpp:277:14:277:15 | xs | test.cpp:278:31:278:31 | x |
637+
| test.cpp:277:14:277:15 | xs | test.cpp:278:31:278:33 | ... ++ |
638+
| test.cpp:277:14:277:15 | xs | test.cpp:278:31:278:33 | ... ++ |
639+
| test.cpp:277:14:277:15 | xs | test.cpp:280:5:280:6 | * ... |
640+
| test.cpp:277:14:277:15 | xs | test.cpp:280:6:280:6 | x |
641+
| test.cpp:277:14:277:15 | xs | test.cpp:280:6:280:6 | x |
642+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:277:14:277:21 | ... + ... |
643+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:277:14:277:21 | ... + ... |
644+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:278:26:278:28 | end |
645+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:278:26:278:28 | end |
646+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:278:26:278:28 | end |
647+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:278:26:278:28 | end |
648+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:280:5:280:10 | Store: ... = ... |
649+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:280:5:280:10 | Store: ... = ... |
650+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:280:5:280:10 | Store: ... = ... |
651+
| test.cpp:277:14:277:21 | ... + ... | test.cpp:280:5:280:10 | Store: ... = ... |
652+
| test.cpp:278:21:278:21 | x | test.cpp:280:5:280:10 | Store: ... = ... |
653+
| test.cpp:278:26:278:28 | end | test.cpp:278:26:278:28 | end |
654+
| test.cpp:278:26:278:28 | end | test.cpp:278:26:278:28 | end |
655+
| test.cpp:278:26:278:28 | end | test.cpp:280:5:280:10 | Store: ... = ... |
656+
| test.cpp:278:26:278:28 | end | test.cpp:280:5:280:10 | Store: ... = ... |
657+
| test.cpp:278:31:278:31 | x | test.cpp:280:5:280:10 | Store: ... = ... |
658+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:278:21:278:21 | x |
659+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:278:21:278:21 | x |
660+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:278:31:278:31 | x |
661+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:278:31:278:31 | x |
662+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:280:5:280:6 | * ... |
663+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:280:5:280:6 | * ... |
664+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:280:6:280:6 | x |
665+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:280:6:280:6 | x |
666+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:280:6:280:6 | x |
667+
| test.cpp:278:31:278:33 | ... ++ | test.cpp:280:6:280:6 | x |
668+
| test.cpp:280:5:280:6 | * ... | test.cpp:280:5:280:10 | Store: ... = ... |
669+
| test.cpp:280:6:280:6 | x | test.cpp:278:31:278:31 | x |
670+
| test.cpp:280:6:280:6 | x | test.cpp:280:5:280:6 | * ... |
671+
| test.cpp:280:6:280:6 | x | test.cpp:280:5:280:10 | Store: ... = ... |
672+
| test.cpp:280:6:280:6 | x | test.cpp:280:5:280:10 | Store: ... = ... |
673+
| test.cpp:286:13:286:24 | new[] | test.cpp:287:14:287:15 | xs |
674+
| test.cpp:287:14:287:15 | xs | test.cpp:288:30:288:32 | ... ++ |
675+
| test.cpp:287:14:287:15 | xs | test.cpp:288:30:288:32 | ... ++ |
676+
| test.cpp:288:21:288:21 | x | test.cpp:290:13:290:14 | Load: * ... |
677+
| test.cpp:288:30:288:30 | x | test.cpp:290:13:290:14 | Load: * ... |
678+
| test.cpp:288:30:288:32 | ... ++ | test.cpp:288:21:288:21 | x |
679+
| test.cpp:288:30:288:32 | ... ++ | test.cpp:288:21:288:21 | x |
680+
| test.cpp:288:30:288:32 | ... ++ | test.cpp:288:30:288:30 | x |
681+
| test.cpp:288:30:288:32 | ... ++ | test.cpp:288:30:288:30 | x |
682+
| test.cpp:288:30:288:32 | ... ++ | test.cpp:290:14:290:14 | x |
683+
| test.cpp:288:30:288:32 | ... ++ | test.cpp:290:14:290:14 | x |
684+
| test.cpp:290:14:290:14 | x | test.cpp:290:13:290:14 | Load: * ... |
685+
| test.cpp:296:13:296:24 | new[] | test.cpp:297:14:297:15 | xs |
686+
| test.cpp:296:13:296:24 | new[] | test.cpp:298:30:298:30 | x |
687+
| test.cpp:297:14:297:15 | xs | test.cpp:298:30:298:32 | ... ++ |
688+
| test.cpp:297:14:297:15 | xs | test.cpp:298:30:298:32 | ... ++ |
689+
| test.cpp:298:21:298:21 | x | test.cpp:300:5:300:10 | Store: ... = ... |
690+
| test.cpp:298:30:298:30 | x | test.cpp:300:5:300:10 | Store: ... = ... |
691+
| test.cpp:298:30:298:32 | ... ++ | test.cpp:298:21:298:21 | x |
692+
| test.cpp:298:30:298:32 | ... ++ | test.cpp:298:21:298:21 | x |
693+
| test.cpp:298:30:298:32 | ... ++ | test.cpp:298:30:298:30 | x |
694+
| test.cpp:298:30:298:32 | ... ++ | test.cpp:298:30:298:30 | x |
695+
| test.cpp:298:30:298:32 | ... ++ | test.cpp:300:5:300:6 | * ... |
696+
| test.cpp:298:30:298:32 | ... ++ | test.cpp:300:5:300:6 | * ... |
697+
| test.cpp:298:30:298:32 | ... ++ | test.cpp:300:6:300:6 | x |
698+
| test.cpp:298:30:298:32 | ... ++ | test.cpp:300:6:300:6 | x |
699+
| test.cpp:300:5:300:6 | * ... | test.cpp:300:5:300:10 | Store: ... = ... |
700+
| test.cpp:300:6:300:6 | x | test.cpp:300:5:300:10 | Store: ... = ... |
589701
#select
590702
| test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
591703
| test.cpp:8:14:8:21 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:8:14:8:21 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -607,3 +719,9 @@ edges
607719
| test.cpp:232:3:232:20 | Store: ... = ... | test.cpp:231:18:231:30 | new[] | test.cpp:232:3:232:20 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:231:18:231:30 | new[] | new[] | test.cpp:232:11:232:15 | index | index |
608720
| test.cpp:239:5:239:22 | Store: ... = ... | test.cpp:238:20:238:32 | new[] | test.cpp:239:5:239:22 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:238:20:238:32 | new[] | new[] | test.cpp:239:13:239:17 | index | index |
609721
| test.cpp:254:9:254:16 | Store: ... = ... | test.cpp:248:24:248:30 | call to realloc | test.cpp:254:9:254:16 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:248:24:248:30 | call to realloc | call to realloc | test.cpp:254:11:254:11 | i | i |
722+
| test.cpp:270:13:270:14 | Load: * ... | test.cpp:266:13:266:24 | new[] | test.cpp:270:13:270:14 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:266:13:266:24 | new[] | new[] | test.cpp:267:19:267:21 | len | len |
723+
| test.cpp:270:13:270:14 | Load: * ... | test.cpp:266:13:266:24 | new[] | test.cpp:270:13:270:14 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:266:13:266:24 | new[] | new[] | test.cpp:267:19:267:21 | len | len |
724+
| test.cpp:280:5:280:10 | Store: ... = ... | test.cpp:276:13:276:24 | new[] | test.cpp:280:5:280:10 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:276:13:276:24 | new[] | new[] | test.cpp:277:19:277:21 | len | len |
725+
| test.cpp:280:5:280:10 | Store: ... = ... | test.cpp:276:13:276:24 | new[] | test.cpp:280:5:280:10 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:276:13:276:24 | new[] | new[] | test.cpp:277:19:277:21 | len | len |
726+
| test.cpp:290:13:290:14 | Load: * ... | test.cpp:286:13:286:24 | new[] | test.cpp:290:13:290:14 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:286:13:286:24 | new[] | new[] | test.cpp:287:19:287:21 | len | len |
727+
| test.cpp:300:5:300:10 | Store: ... = ... | test.cpp:296:13:296:24 | new[] | test.cpp:300:5:300:10 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:296:13:296:24 | new[] | new[] | test.cpp:297:19:297:21 | len | len |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -254,3 +254,49 @@ void test17(unsigned *p, unsigned x, unsigned k) {
254254
p[i] = x; // GOOD [FALSE POSITIVE]
255255
}
256256
}
257+
258+
struct array_with_size
259+
{
260+
int *xs;
261+
unsigned len;
262+
};
263+
264+
void test17(unsigned len, array_with_size *s)
265+
{
266+
int *xs = new int[len];
267+
int *end = xs + len;
268+
for (int *x = xs; x <= end; x++)
269+
{
270+
int i = *x; // BAD
271+
}
272+
}
273+
274+
void test18(unsigned len, array_with_size *s)
275+
{
276+
int *xs = new int[len];
277+
int *end = xs + len;
278+
for (int *x = xs; x <= end; x++)
279+
{
280+
*x = 0; // BAD
281+
}
282+
}
283+
284+
void test19(unsigned len, array_with_size *s)
285+
{
286+
int *xs = new int[len];
287+
int *end = xs + len;
288+
for (int *x = xs; x < end; x++)
289+
{
290+
int i = *x; // GOOD [FALSE POSITIVE]
291+
}
292+
}
293+
294+
void test20(unsigned len, array_with_size *s)
295+
{
296+
int *xs = new int[len];
297+
int *end = xs + len;
298+
for (int *x = xs; x < end; x++)
299+
{
300+
*x = 0; // GOOD [FALSE POSITIVE]
301+
}
302+
}

0 commit comments

Comments
 (0)