Skip to content

Commit fcd0bb1

Browse files
rdmarsh2rdmarsh2
committed
C++: add paths to ArrayAccessProductFlow
1 parent c7ccff2 commit fcd0bb1

File tree

2 files changed

+116
-3
lines changed

2 files changed

+116
-3
lines changed

‎cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
/**
2+
* @id cpp/off-by-one-array-access
3+
* @kind path-problem
4+
*/
5+
16
import cpp
27
import experimental.semmle.code.cpp.dataflow.ProductFlow
38
import experimental.semmle.code.cpp.semantic.analysis.RangeAnalysis
@@ -8,13 +13,22 @@ import semmle.code.cpp.valuenumbering.GlobalValueNumbering
813
import semmle.code.cpp.models.interfaces.Allocation
914
import semmle.code.cpp.ir.IRConfiguration
1015

16+
import DataFlow::PathGraph
17+
1118
// temporary - custom allocator for ffmpeg
1219
class AvBufferAlloc extends AllocationFunction {
1320
AvBufferAlloc() { this.hasGlobalName(["av_mallocz", "av_malloc"]) }
1421

1522
override int getSizeArg() { result = 0 }
1623
}
1724

25+
// temporary - custom allocator for php
26+
class PhpEmalloc extends AllocationFunction {
27+
PhpEmalloc() { this.hasGlobalName(["_emalloc"]) }
28+
29+
override int getSizeArg() { result = 0 }
30+
}
31+
1832
predicate bounded(Instruction i, Bound b, int delta, boolean upper) {
1933
// TODO: reason
2034
semBounded(getSemanticExpr(i), b, delta, upper, _)
@@ -61,4 +75,5 @@ from
6175
DataFlow::PathNode sink1, DataFlow2::PathNode sink2
6276
where conf.hasFlowPath(source1, source2, sink1, sink2)
6377
// TODO: pull delta out and display it
64-
select source1, source2, sink1, sink2
78+
select sink1, source1, sink1, "off-by one error allocated at $@ bounded by $@", source1, source1,
79+
sink2, sink2

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.expected

Lines changed: 100 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,100 @@
1-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | Load | test.cpp:5:25:5:28 | Load |
2-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | Load | test.cpp:9:26:9:29 | Load |
1+
edges
2+
| test.cpp:4:17:4:22 | call to malloc | test.cpp:6:9:6:11 | Load |
3+
| test.cpp:4:17:4:22 | call to malloc | test.cpp:10:9:10:11 | Load |
4+
| test.cpp:19:9:19:16 | VariableAddress indirection [p] | test.cpp:31:9:31:11 | arr indirection [p] |
5+
| test.cpp:19:9:19:16 | VariableAddress indirection [p] | test.cpp:35:9:35:11 | arr indirection [p] |
6+
| test.cpp:19:9:19:16 | VariableAddress indirection [p] | test.cpp:50:18:50:25 | call to mk_array [p] |
7+
| test.cpp:22:5:22:24 | Store | test.cpp:22:9:22:9 | arr indirection [post update] [p] |
8+
| test.cpp:22:9:22:9 | arr indirection [post update] [p] | test.cpp:19:9:19:16 | VariableAddress indirection [p] |
9+
| test.cpp:22:13:22:18 | call to malloc | test.cpp:22:5:22:24 | Store |
10+
| test.cpp:31:9:31:11 | arr indirection [p] | test.cpp:31:13:31:13 | p |
11+
| test.cpp:31:13:31:13 | p | test.cpp:31:13:31:13 | Load |
12+
| test.cpp:35:9:35:11 | arr indirection [p] | test.cpp:35:13:35:13 | p |
13+
| test.cpp:35:13:35:13 | p | test.cpp:35:13:35:13 | Load |
14+
| test.cpp:39:27:39:29 | arr [p] | test.cpp:41:9:41:11 | arr indirection [p] |
15+
| test.cpp:39:27:39:29 | arr [p] | test.cpp:45:9:45:11 | arr indirection [p] |
16+
| test.cpp:41:9:41:11 | arr indirection [p] | test.cpp:41:13:41:13 | p |
17+
| test.cpp:41:13:41:13 | p | test.cpp:41:13:41:13 | Load |
18+
| test.cpp:45:9:45:11 | arr indirection [p] | test.cpp:45:13:45:13 | p |
19+
| test.cpp:45:13:45:13 | p | test.cpp:45:13:45:13 | Load |
20+
| test.cpp:50:18:50:25 | call to mk_array [p] | test.cpp:39:27:39:29 | arr [p] |
21+
| test.cpp:56:5:56:24 | Store | test.cpp:56:9:56:9 | arr indirection [post update] [p] |
22+
| test.cpp:56:9:56:9 | arr indirection [post update] [p] | test.cpp:59:9:59:11 | arr indirection [p] |
23+
| test.cpp:56:9:56:9 | arr indirection [post update] [p] | test.cpp:63:9:63:11 | arr indirection [p] |
24+
| test.cpp:56:13:56:18 | call to malloc | test.cpp:56:5:56:24 | Store |
25+
| test.cpp:59:9:59:11 | arr indirection [p] | test.cpp:59:13:59:13 | p |
26+
| test.cpp:59:13:59:13 | p | test.cpp:59:13:59:13 | Load |
27+
| test.cpp:63:9:63:11 | arr indirection [p] | test.cpp:63:13:63:13 | p |
28+
| test.cpp:63:13:63:13 | p | test.cpp:63:13:63:13 | Load |
29+
| test.cpp:67:10:67:19 | VariableAddress indirection [p] | test.cpp:76:20:76:29 | Call indirection [p] |
30+
| test.cpp:67:10:67:19 | VariableAddress indirection [p] | test.cpp:98:18:98:27 | call to mk_array_p indirection [p] |
31+
| test.cpp:70:5:70:25 | Store | test.cpp:70:10:70:10 | Load indirection [post update] [p] |
32+
| test.cpp:70:10:70:10 | Load indirection [post update] [p] | test.cpp:67:10:67:19 | VariableAddress indirection [p] |
33+
| test.cpp:70:14:70:19 | call to malloc | test.cpp:70:5:70:25 | Store |
34+
| test.cpp:76:20:76:29 | Call indirection [p] | test.cpp:79:9:79:11 | Load indirection [p] |
35+
| test.cpp:76:20:76:29 | Call indirection [p] | test.cpp:83:9:83:11 | Load indirection [p] |
36+
| test.cpp:79:9:79:11 | Load indirection [p] | test.cpp:79:14:79:14 | p |
37+
| test.cpp:79:14:79:14 | p | test.cpp:79:14:79:14 | Load |
38+
| test.cpp:83:9:83:11 | Load indirection [p] | test.cpp:83:14:83:14 | p |
39+
| test.cpp:83:14:83:14 | p | test.cpp:83:14:83:14 | Load |
40+
| test.cpp:87:28:87:30 | arr indirection [p] | test.cpp:89:9:89:11 | Load indirection [p] |
41+
| test.cpp:87:28:87:30 | arr indirection [p] | test.cpp:93:9:93:11 | Load indirection [p] |
42+
| test.cpp:89:9:89:11 | Load indirection [p] | test.cpp:89:14:89:14 | p |
43+
| test.cpp:89:14:89:14 | p | test.cpp:89:14:89:14 | Load |
44+
| test.cpp:93:9:93:11 | Load indirection [p] | test.cpp:93:14:93:14 | p |
45+
| test.cpp:93:14:93:14 | p | test.cpp:93:14:93:14 | Load |
46+
| test.cpp:98:18:98:27 | call to mk_array_p indirection [p] | test.cpp:87:28:87:30 | arr indirection [p] |
47+
nodes
48+
| test.cpp:4:17:4:22 | call to malloc | semmle.label | call to malloc |
49+
| test.cpp:6:9:6:11 | Load | semmle.label | Load |
50+
| test.cpp:10:9:10:11 | Load | semmle.label | Load |
51+
| test.cpp:19:9:19:16 | VariableAddress indirection [p] | semmle.label | VariableAddress indirection [p] |
52+
| test.cpp:22:5:22:24 | Store | semmle.label | Store |
53+
| test.cpp:22:9:22:9 | arr indirection [post update] [p] | semmle.label | arr indirection [post update] [p] |
54+
| test.cpp:22:13:22:18 | call to malloc | semmle.label | call to malloc |
55+
| test.cpp:31:9:31:11 | arr indirection [p] | semmle.label | arr indirection [p] |
56+
| test.cpp:31:13:31:13 | Load | semmle.label | Load |
57+
| test.cpp:31:13:31:13 | p | semmle.label | p |
58+
| test.cpp:35:9:35:11 | arr indirection [p] | semmle.label | arr indirection [p] |
59+
| test.cpp:35:13:35:13 | Load | semmle.label | Load |
60+
| test.cpp:35:13:35:13 | p | semmle.label | p |
61+
| test.cpp:39:27:39:29 | arr [p] | semmle.label | arr [p] |
62+
| test.cpp:41:9:41:11 | arr indirection [p] | semmle.label | arr indirection [p] |
63+
| test.cpp:41:13:41:13 | Load | semmle.label | Load |
64+
| test.cpp:41:13:41:13 | p | semmle.label | p |
65+
| test.cpp:45:9:45:11 | arr indirection [p] | semmle.label | arr indirection [p] |
66+
| test.cpp:45:13:45:13 | Load | semmle.label | Load |
67+
| test.cpp:45:13:45:13 | p | semmle.label | p |
68+
| test.cpp:50:18:50:25 | call to mk_array [p] | semmle.label | call to mk_array [p] |
69+
| test.cpp:56:5:56:24 | Store | semmle.label | Store |
70+
| test.cpp:56:9:56:9 | arr indirection [post update] [p] | semmle.label | arr indirection [post update] [p] |
71+
| test.cpp:56:13:56:18 | call to malloc | semmle.label | call to malloc |
72+
| test.cpp:59:9:59:11 | arr indirection [p] | semmle.label | arr indirection [p] |
73+
| test.cpp:59:13:59:13 | Load | semmle.label | Load |
74+
| test.cpp:59:13:59:13 | p | semmle.label | p |
75+
| test.cpp:63:9:63:11 | arr indirection [p] | semmle.label | arr indirection [p] |
76+
| test.cpp:63:13:63:13 | Load | semmle.label | Load |
77+
| test.cpp:63:13:63:13 | p | semmle.label | p |
78+
| test.cpp:67:10:67:19 | VariableAddress indirection [p] | semmle.label | VariableAddress indirection [p] |
79+
| test.cpp:70:5:70:25 | Store | semmle.label | Store |
80+
| test.cpp:70:10:70:10 | Load indirection [post update] [p] | semmle.label | Load indirection [post update] [p] |
81+
| test.cpp:70:14:70:19 | call to malloc | semmle.label | call to malloc |
82+
| test.cpp:76:20:76:29 | Call indirection [p] | semmle.label | Call indirection [p] |
83+
| test.cpp:79:9:79:11 | Load indirection [p] | semmle.label | Load indirection [p] |
84+
| test.cpp:79:14:79:14 | Load | semmle.label | Load |
85+
| test.cpp:79:14:79:14 | p | semmle.label | p |
86+
| test.cpp:83:9:83:11 | Load indirection [p] | semmle.label | Load indirection [p] |
87+
| test.cpp:83:14:83:14 | Load | semmle.label | Load |
88+
| test.cpp:83:14:83:14 | p | semmle.label | p |
89+
| test.cpp:87:28:87:30 | arr indirection [p] | semmle.label | arr indirection [p] |
90+
| test.cpp:89:9:89:11 | Load indirection [p] | semmle.label | Load indirection [p] |
91+
| test.cpp:89:14:89:14 | Load | semmle.label | Load |
92+
| test.cpp:89:14:89:14 | p | semmle.label | p |
93+
| test.cpp:93:9:93:11 | Load indirection [p] | semmle.label | Load indirection [p] |
94+
| test.cpp:93:14:93:14 | Load | semmle.label | Load |
95+
| test.cpp:93:14:93:14 | p | semmle.label | p |
96+
| test.cpp:98:18:98:27 | call to mk_array_p indirection [p] | semmle.label | call to mk_array_p indirection [p] |
97+
subpaths
98+
#select
99+
| test.cpp:10:9:10:11 | Load | test.cpp:4:17:4:22 | call to malloc | test.cpp:10:9:10:11 | Load | off-by one error allocated at $@ bounded by $@ | test.cpp:4:17:4:22 | call to malloc | test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | Load | test.cpp:5:25:5:28 | Load |
100+
| test.cpp:10:9:10:11 | Load | test.cpp:4:17:4:22 | call to malloc | test.cpp:10:9:10:11 | Load | off-by one error allocated at $@ bounded by $@ | test.cpp:4:17:4:22 | call to malloc | test.cpp:4:17:4:22 | call to malloc | test.cpp:9:26:9:29 | Load | test.cpp:9:26:9:29 | Load |

0 commit comments

Comments
 (0)