Skip to content

Commit d73604d

Browse files
geoffw0geoffw0
committed
C++: Fix a few glitches and accept line number changes in expected files.
1 parent f755659 commit d73604d

File tree

19 files changed

+135
-94
lines changed

19 files changed

+135
-94
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-022/SAMATE/TaintedPath/CWE23_Relative_Path_Traversal__char_console_fopen_11.cpp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
#define NULL (0)
77

8+
typedef unsigned long size_t;
89
typedef size_t time_t;
910
time_t time(time_t *timer);
1011

@@ -129,3 +130,5 @@ static void goodG2B2()
129130
}
130131
}
131132
}
133+
134+
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/ExecTainted.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
| tests.cpp:55:16:55:19 | data | This argument to an OS command is derived from $@ and then passed to system(string) | tests.cpp:35:34:35:39 | call to getenv | user input (getenv) |
1+
| tests.cpp:53:16:53:19 | data | This argument to an OS command is derived from $@ and then passed to system(string) | tests.cpp:33:34:33:39 | call to getenv | user input (getenv) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-078/SAMATE/ExecTainted/tests.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
#define NULL (0)
77
typedef unsigned long size_t;
88
size_t strlen(const char *s);
9-
char *strncat(char *s1, const char *s2, size_t n);n);
9+
char *strncat(char *s1, const char *s2, size_t n);
1010
char *getenv(const char *name);
1111
int system(const char *string);
1212
void exit(int status);

‎cpp/ql/test/query-tests/Security/CWE/CWE-114/SAMATE/UncontrolledProcessOperation/UncontrolledProcessOperation.expected

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
11
edges
2-
| test.cpp:35:73:35:76 | *data | test.cpp:41:32:41:35 | (LPCSTR)... |
3-
| test.cpp:35:73:35:76 | *data | test.cpp:41:32:41:35 | data |
4-
| test.cpp:35:73:35:76 | *data | test.cpp:41:32:41:35 | data indirection |
5-
| test.cpp:35:73:35:76 | data | test.cpp:41:32:41:35 | (LPCSTR)... |
6-
| test.cpp:35:73:35:76 | data | test.cpp:41:32:41:35 | data |
7-
| test.cpp:35:73:35:76 | data | test.cpp:41:32:41:35 | data |
8-
| test.cpp:35:73:35:76 | data | test.cpp:41:32:41:35 | data indirection |
9-
| test.cpp:62:30:62:35 | call to getenv | test.cpp:71:17:71:22 | data |
10-
| test.cpp:62:30:62:35 | call to getenv | test.cpp:71:17:71:22 | data |
11-
| test.cpp:62:30:62:35 | call to getenv | test.cpp:71:24:71:27 | data indirection |
12-
| test.cpp:62:30:62:35 | call to getenv | test.cpp:71:24:71:27 | data indirection |
13-
| test.cpp:71:17:71:22 | data | test.cpp:35:73:35:76 | data |
14-
| test.cpp:71:24:71:27 | data indirection | test.cpp:35:73:35:76 | *data |
2+
| test.cpp:37:73:37:76 | *data | test.cpp:43:32:43:35 | (LPCSTR)... |
3+
| test.cpp:37:73:37:76 | *data | test.cpp:43:32:43:35 | data |
4+
| test.cpp:37:73:37:76 | *data | test.cpp:43:32:43:35 | data indirection |
5+
| test.cpp:37:73:37:76 | data | test.cpp:43:32:43:35 | (LPCSTR)... |
6+
| test.cpp:37:73:37:76 | data | test.cpp:43:32:43:35 | data |
7+
| test.cpp:37:73:37:76 | data | test.cpp:43:32:43:35 | data |
8+
| test.cpp:37:73:37:76 | data | test.cpp:43:32:43:35 | data indirection |
9+
| test.cpp:64:30:64:35 | call to getenv | test.cpp:73:17:73:22 | data |
10+
| test.cpp:64:30:64:35 | call to getenv | test.cpp:73:17:73:22 | data |
11+
| test.cpp:64:30:64:35 | call to getenv | test.cpp:73:24:73:27 | data indirection |
12+
| test.cpp:64:30:64:35 | call to getenv | test.cpp:73:24:73:27 | data indirection |
13+
| test.cpp:73:17:73:22 | data | test.cpp:37:73:37:76 | data |
14+
| test.cpp:73:24:73:27 | data indirection | test.cpp:37:73:37:76 | *data |
1515
nodes
16-
| test.cpp:35:73:35:76 | *data | semmle.label | *data |
17-
| test.cpp:35:73:35:76 | data | semmle.label | data |
18-
| test.cpp:41:32:41:35 | (LPCSTR)... | semmle.label | (LPCSTR)... |
19-
| test.cpp:41:32:41:35 | (LPCSTR)... | semmle.label | (LPCSTR)... |
20-
| test.cpp:41:32:41:35 | data | semmle.label | data |
21-
| test.cpp:41:32:41:35 | data | semmle.label | data |
22-
| test.cpp:41:32:41:35 | data | semmle.label | data |
23-
| test.cpp:41:32:41:35 | data indirection | semmle.label | data indirection |
24-
| test.cpp:41:32:41:35 | data indirection | semmle.label | data indirection |
25-
| test.cpp:62:30:62:35 | call to getenv | semmle.label | call to getenv |
26-
| test.cpp:62:30:62:35 | call to getenv | semmle.label | call to getenv |
27-
| test.cpp:71:17:71:22 | data | semmle.label | data |
28-
| test.cpp:71:24:71:27 | data indirection | semmle.label | data indirection |
16+
| test.cpp:37:73:37:76 | *data | semmle.label | *data |
17+
| test.cpp:37:73:37:76 | data | semmle.label | data |
18+
| test.cpp:43:32:43:35 | (LPCSTR)... | semmle.label | (LPCSTR)... |
19+
| test.cpp:43:32:43:35 | (LPCSTR)... | semmle.label | (LPCSTR)... |
20+
| test.cpp:43:32:43:35 | data | semmle.label | data |
21+
| test.cpp:43:32:43:35 | data | semmle.label | data |
22+
| test.cpp:43:32:43:35 | data | semmle.label | data |
23+
| test.cpp:43:32:43:35 | data indirection | semmle.label | data indirection |
24+
| test.cpp:43:32:43:35 | data indirection | semmle.label | data indirection |
25+
| test.cpp:64:30:64:35 | call to getenv | semmle.label | call to getenv |
26+
| test.cpp:64:30:64:35 | call to getenv | semmle.label | call to getenv |
27+
| test.cpp:73:17:73:22 | data | semmle.label | data |
28+
| test.cpp:73:24:73:27 | data indirection | semmle.label | data indirection |
2929
#select
30-
| test.cpp:41:32:41:35 | data | test.cpp:62:30:62:35 | call to getenv | test.cpp:41:32:41:35 | data | The value of this argument may come from $@ and is being passed to LoadLibraryA | test.cpp:62:30:62:35 | call to getenv | call to getenv |
30+
| test.cpp:43:32:43:35 | data | test.cpp:64:30:64:35 | call to getenv | test.cpp:43:32:43:35 | data | The value of this argument may come from $@ and is being passed to LoadLibraryA | test.cpp:64:30:64:35 | call to getenv | call to getenv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/BadlyBoundedWrite.expected

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
| tests.cpp:352:13:352:19 | call to strncat | This 'call to strncat' operation is limited to 100 bytes but the destination is only 50 bytes. |
2-
| tests.cpp:454:9:454:15 | call to wcsncpy | This 'call to wcsncpy' operation is limited to 198 bytes but the destination is only 100 bytes. |
3-
| tests.cpp:483:9:483:16 | call to swprintf | This 'call to swprintf' operation is limited to 200 bytes but the destination is only 100 bytes. |
4-
| tests.cpp:632:13:632:20 | call to swprintf | This 'call to swprintf' operation is limited to 200 bytes but the destination is only 100 bytes. |
1+
| tests.cpp:350:13:350:19 | call to strncat | This 'call to strncat' operation is limited to 100 bytes but the destination is only 50 bytes. |
2+
| tests.cpp:452:9:452:15 | call to wcsncpy | This 'call to wcsncpy' operation is limited to 396 bytes but the destination is only 200 bytes. |
3+
| tests.cpp:481:9:481:16 | call to swprintf | This 'call to swprintf' operation is limited to 400 bytes but the destination is only 200 bytes. |
4+
| tests.cpp:630:13:630:20 | call to swprintf | This 'call to swprintf' operation is limited to 400 bytes but the destination is only 200 bytes. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowBuffer.expected

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
1-
| tests.cpp:47:9:47:14 | call to memcpy | This 'memcpy' operation accesses 32 bytes but the $@ is only 16 bytes. | tests.cpp:34:10:34:18 | charFirst | destination buffer |
2-
| tests.cpp:62:9:62:14 | call to memcpy | This 'memcpy' operation accesses 32 bytes but the $@ is only 16 bytes. | tests.cpp:34:10:34:18 | charFirst | destination buffer |
3-
| tests.cpp:173:9:173:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:166:20:166:25 | call to malloc | destination buffer |
4-
| tests.cpp:174:9:174:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:166:20:166:25 | call to malloc | array |
5-
| tests.cpp:194:9:194:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:183:10:183:22 | dataBadBuffer | destination buffer |
6-
| tests.cpp:194:9:194:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:187:12:187:24 | dataBadBuffer | destination buffer |
7-
| tests.cpp:195:9:195:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:183:10:183:22 | dataBadBuffer | array |
8-
| tests.cpp:195:9:195:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:187:12:187:24 | dataBadBuffer | array |
9-
| tests.cpp:214:9:214:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:203:36:203:41 | call to alloca | destination buffer |
10-
| tests.cpp:214:9:214:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:207:12:207:24 | dataBadBuffer | destination buffer |
11-
| tests.cpp:215:9:215:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:203:36:203:41 | call to alloca | array |
12-
| tests.cpp:215:9:215:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:207:12:207:24 | dataBadBuffer | array |
13-
| tests.cpp:239:9:239:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:223:36:223:41 | call to alloca | array |
14-
| tests.cpp:239:9:239:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:227:12:227:24 | dataBadBuffer | array |
15-
| tests.cpp:263:9:263:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:247:10:247:22 | dataBadBuffer | array |
16-
| tests.cpp:263:9:263:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:251:12:251:24 | dataBadBuffer | array |
17-
| tests.cpp:386:9:386:14 | call to memcpy | This 'memcpy' operation accesses 40 bytes but the $@ is only 10 bytes. | tests.cpp:382:19:382:24 | call to alloca | destination buffer |
18-
| tests.cpp:436:9:436:19 | access to array | This array indexing operation accesses byte offset 199 but the $@ is only 100 bytes. | tests.cpp:424:12:424:26 | new[] | array |
19-
| tests.cpp:455:9:455:19 | access to array | This array indexing operation accesses byte offset 199 but the $@ is only 100 bytes. | tests.cpp:447:12:447:26 | new[] | array |
1+
| tests.cpp:45:9:45:14 | call to memcpy | This 'memcpy' operation accesses 32 bytes but the $@ is only 16 bytes. | tests.cpp:32:10:32:18 | charFirst | destination buffer |
2+
| tests.cpp:60:9:60:14 | call to memcpy | This 'memcpy' operation accesses 32 bytes but the $@ is only 16 bytes. | tests.cpp:32:10:32:18 | charFirst | destination buffer |
3+
| tests.cpp:171:9:171:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:164:20:164:25 | call to malloc | destination buffer |
4+
| tests.cpp:172:9:172:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:164:20:164:25 | call to malloc | array |
5+
| tests.cpp:192:9:192:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:181:10:181:22 | dataBadBuffer | destination buffer |
6+
| tests.cpp:192:9:192:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:185:12:185:24 | dataBadBuffer | destination buffer |
7+
| tests.cpp:193:9:193:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:181:10:181:22 | dataBadBuffer | array |
8+
| tests.cpp:193:9:193:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:185:12:185:24 | dataBadBuffer | array |
9+
| tests.cpp:212:9:212:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:201:36:201:41 | call to alloca | destination buffer |
10+
| tests.cpp:212:9:212:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:205:12:205:24 | dataBadBuffer | destination buffer |
11+
| tests.cpp:213:9:213:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:201:36:201:41 | call to alloca | array |
12+
| tests.cpp:213:9:213:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:205:12:205:24 | dataBadBuffer | array |
13+
| tests.cpp:237:9:237:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:221:36:221:41 | call to alloca | array |
14+
| tests.cpp:237:9:237:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:225:12:225:24 | dataBadBuffer | array |
15+
| tests.cpp:261:9:261:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:245:10:245:22 | dataBadBuffer | array |
16+
| tests.cpp:261:9:261:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:249:12:249:24 | dataBadBuffer | array |
17+
| tests.cpp:384:9:384:14 | call to memcpy | This 'memcpy' operation accesses 40 bytes but the $@ is only 10 bytes. | tests.cpp:380:19:380:24 | call to alloca | destination buffer |
18+
| tests.cpp:434:9:434:19 | access to array | This array indexing operation accesses byte offset 399 but the $@ is only 200 bytes. | tests.cpp:422:12:422:26 | new[] | array |
19+
| tests.cpp:453:9:453:19 | access to array | This array indexing operation accesses byte offset 399 but the $@ is only 200 bytes. | tests.cpp:445:12:445:26 | new[] | array |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowStatic.expected

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
| tests.cpp:47:51:47:72 | sizeof(<expr>) | Potential buffer-overflow: 'charFirst' has size 16 not 32. |
2-
| tests.cpp:62:52:62:74 | sizeof(<expr>) | Potential buffer-overflow: 'charFirst' has size 16 not 32. |
1+
| tests.cpp:45:51:45:72 | sizeof(<expr>) | Potential buffer-overflow: 'charFirst' has size 16 not 32. |
2+
| tests.cpp:60:52:60:74 | sizeof(<expr>) | Potential buffer-overflow: 'charFirst' has size 16 not 32. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/StrncpyFlippedArgs.expected

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
| tests.cpp:292:13:292:19 | call to wcsncpy | Potentially unsafe call to wcsncpy; third argument should be size of destination. |
2-
| tests.cpp:308:4:308:10 | call to wcsncpy | Potentially unsafe call to wcsncpy; third argument should be size of destination. |
3-
| tests.cpp:454:9:454:15 | call to wcsncpy | Potentially unsafe call to wcsncpy; third argument should be size of destination. |
1+
| tests.cpp:290:13:290:19 | call to wcsncpy | Potentially unsafe call to wcsncpy; third argument should be size of destination. |
2+
| tests.cpp:306:4:306:10 | call to wcsncpy | Potentially unsafe call to wcsncpy; third argument should be size of destination. |
3+
| tests.cpp:452:9:452:15 | call to wcsncpy | Potentially unsafe call to wcsncpy; third argument should be size of destination. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
//semmle-extractor-options: --edg --target --edg win64
2-
31
// A sample of tests from the SAMATE Juliet framework for rule CWE-119.
42

53
// library types, functions etc

‎cpp/ql/test/query-tests/Security/CWE/CWE-129/SAMATE/ImproperArrayIndexValidation/ImproperArrayIndexValidation.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
| CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01.c:51:20:51:23 | data | $@ flows to here and is used in an array indexing expression, potentially causing an invalid access. | CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01.c:29:19:29:29 | inputBuffer | User-provided value |
1+
| CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01.c:52:20:52:23 | data | $@ flows to here and is used in an array indexing expression, potentially causing an invalid access. | CWE122_Heap_Based_Buffer_Overflow__c_CWE129_fgets_01.c:30:19:30:29 | inputBuffer | User-provided value |

0 commit comments

Comments
 (0)