|
7 | 7 | import semmle.code.cpp.models.interfaces.Allocation |
8 | 8 | import semmle.code.cpp.models.interfaces.Taint |
9 | 9 |
|
10 | | -/** |
11 | | - * An allocation function (such as `malloc`) that has an argument for the size |
12 | | - * in bytes. |
13 | | - */ |
14 | | -private class MallocAllocationFunction extends AllocationFunction { |
15 | | - int sizeArg; |
16 | | - |
17 | | - MallocAllocationFunction() { |
18 | | - // --- C library allocation |
19 | | - this.hasGlobalOrStdOrBslName("malloc") and // malloc(size) |
20 | | - sizeArg = 0 |
21 | | - or |
22 | | - this.hasGlobalName([ |
23 | | - // --- Windows Memory Management for Windows Drivers |
24 | | - "MmAllocateContiguousMemory", // MmAllocateContiguousMemory(size, maxaddress) |
25 | | - "MmAllocateContiguousNodeMemory", // MmAllocateContiguousNodeMemory(size, minaddress, maxaddress, bound, flag, prefer) |
26 | | - "MmAllocateContiguousMemorySpecifyCache", // MmAllocateContiguousMemorySpecifyCache(size, minaddress, maxaddress, bound, type) |
27 | | - "MmAllocateContiguousMemorySpecifyCacheNode", // MmAllocateContiguousMemorySpecifyCacheNode(size, minaddress, maxaddress, bound, type, prefer) |
28 | | - "MmAllocateNonCachedMemory", // MmAllocateNonCachedMemory(size) |
29 | | - "MmAllocateMappingAddress", // MmAllocateMappingAddress(size, tag) |
30 | | - // --- Windows COM allocation |
31 | | - "CoTaskMemAlloc", // CoTaskMemAlloc(size) |
32 | | - // --- Solaris/BSD kernel memory allocator |
33 | | - "kmem_alloc", // kmem_alloc(size, flags) |
34 | | - "kmem_zalloc", // kmem_zalloc(size, flags) |
35 | | - // --- OpenSSL memory allocation |
36 | | - "CRYPTO_malloc", // CRYPTO_malloc(size_t num, const char *file, int line) |
37 | | - "CRYPTO_zalloc", // CRYPTO_zalloc(size_t num, const char *file, int line) |
38 | | - "CRYPTO_secure_malloc", // CRYPTO_secure_malloc(size_t num, const char *file, int line) |
39 | | - "CRYPTO_secure_zalloc", // CRYPTO_secure_zalloc(size_t num, const char *file, int line) |
40 | | - "g_malloc", // g_malloc (n_bytes); |
41 | | - "g_try_malloc" // g_try_malloc(n_bytes); |
42 | | - ]) and |
43 | | - sizeArg = 0 |
44 | | - or |
45 | | - this.hasGlobalName([ |
46 | | - // --- Windows Memory Management for Windows Drivers |
47 | | - "ExAllocatePool", // ExAllocatePool(type, size) |
48 | | - "ExAllocatePool2", // ExAllocatePool2(flags, size, tag) |
49 | | - "ExAllocatePool3", // ExAllocatePool3(flags, size, tag, extparams, extparamscount) |
50 | | - "ExAllocatePoolWithTag", // ExAllocatePool(type, size, tag) |
51 | | - "ExAllocatePoolWithTagPriority", // ExAllocatePoolWithTagPriority(type, size, tag, priority) |
52 | | - "ExAllocatePoolWithQuota", // ExAllocatePoolWithQuota(type, size) |
53 | | - "ExAllocatePoolWithQuotaTag", // ExAllocatePoolWithQuotaTag(type, size, tag) |
54 | | - "ExAllocatePoolZero", // ExAllocatePoolZero(type, size, tag) |
55 | | - "IoAllocateMdl", // IoAllocateMdl(address, size, flag, flag, irp) |
56 | | - "IoAllocateErrorLogEntry", // IoAllocateErrorLogEntry(object, size) |
57 | | - // --- Windows Global / Local legacy allocation |
58 | | - "LocalAlloc", // LocalAlloc(flags, size) |
59 | | - "GlobalAlloc", // GlobalAlloc(flags, size) |
60 | | - // --- Windows System Services allocation |
61 | | - "VirtualAlloc" // VirtualAlloc(address, size, type, flag) |
62 | | - ]) and |
63 | | - sizeArg = 1 |
64 | | - or |
65 | | - this.hasGlobalName("HeapAlloc") and // HeapAlloc(heap, flags, size) |
66 | | - sizeArg = 2 |
67 | | - or |
68 | | - this.hasGlobalName([ |
69 | | - // --- Windows Memory Management for Windows Drivers |
70 | | - "MmAllocatePagesForMdl", // MmAllocatePagesForMdl(minaddress, maxaddress, skip, size) |
71 | | - "MmAllocatePagesForMdlEx", // MmAllocatePagesForMdlEx(minaddress, maxaddress, skip, size, type, flags) |
72 | | - "MmAllocateNodePagesForMdlEx" // MmAllocateNodePagesForMdlEx(minaddress, maxaddress, skip, size, type, prefer, flags) |
73 | | - ]) and |
74 | | - sizeArg = 3 |
75 | | - } |
76 | | - |
77 | | - override int getSizeArg() { result = sizeArg } |
78 | | -} |
79 | | - |
80 | | -/** |
81 | | - * An allocation function (such as `alloca`) that does not require a |
82 | | - * corresponding free (and has an argument for the size in bytes). |
83 | | - */ |
84 | | -private class AllocaAllocationFunction extends AllocationFunction { |
85 | | - int sizeArg; |
86 | | - |
87 | | - AllocaAllocationFunction() { |
88 | | - this.hasGlobalName([ |
89 | | - // --- stack allocation |
90 | | - "alloca", // // alloca(size) |
91 | | - "__builtin_alloca", // __builtin_alloca(size) |
92 | | - "_alloca", // _alloca(size) |
93 | | - "_malloca" // _malloca(size) |
94 | | - ]) and |
95 | | - sizeArg = 0 |
96 | | - } |
97 | | - |
98 | | - override int getSizeArg() { result = sizeArg } |
99 | | - |
100 | | - override predicate requiresDealloc() { none() } |
101 | | -} |
102 | | - |
103 | | -/** |
104 | | - * An allocation function (such as `calloc`) that has an argument for the size |
105 | | - * and another argument for the size of those units (in bytes). |
106 | | - */ |
107 | | -private class CallocAllocationFunction extends AllocationFunction { |
108 | | - int sizeArg; |
109 | | - int multArg; |
110 | | - |
111 | | - CallocAllocationFunction() { |
112 | | - // --- C library allocation |
113 | | - this.hasGlobalOrStdOrBslName("calloc") and // calloc(num, size) |
114 | | - sizeArg = 1 and |
115 | | - multArg = 0 |
116 | | - } |
117 | | - |
118 | | - override int getSizeArg() { result = sizeArg } |
119 | | - |
120 | | - override int getSizeMult() { result = multArg } |
121 | | -} |
122 | | - |
123 | 10 | /** |
124 | 11 | * An allocation function (such as `realloc`) that has an argument for the size |
125 | 12 | * in bytes, and an argument for an existing pointer that is to be reallocated. |
|
0 commit comments