C++: Add more FNs and FPs to show examples of where the 'successor typing' strategy fails.

Author: MathiasVP

cpp/ql/test/query-tests/Security/CWE/CWE-843/TypeConfusion.expected

@@ -5,6 +5,8 @@ edges
 | test.cpp:85:9:85:15 | new | test.cpp:88:14:88:33 | a | provenance |  |
 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | provenance |  |
 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance |  |
+| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance |  |
+| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance |  |
 nodes
 | test.cpp:27:13:27:18 | new | semmle.label | new |
 | test.cpp:28:25:28:55 | p | semmle.label | p |
@@ -18,10 +20,15 @@ nodes
 | test.cpp:128:24:128:59 | s2 | semmle.label | s2 |
 | test.cpp:143:14:143:19 | new | semmle.label | new |
 | test.cpp:145:28:145:68 | s1_2 | semmle.label | s1_2 |
+| test.cpp:153:9:153:15 | new | semmle.label | new |
+| test.cpp:159:14:159:33 | a | semmle.label | a |
+| test.cpp:168:9:168:15 | new | semmle.label | new |
+| test.cpp:171:14:171:33 | a | semmle.label | a |
 subpaths
 #select
 | test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
 | test.cpp:33:12:33:30 | p | test.cpp:32:13:32:30 | new | test.cpp:33:12:33:30 | p | Conversion from $@ to $@ is invalid. | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper | test.cpp:1:8:1:9 | S1 | S1 |
 | test.cpp:67:12:67:31 | a | test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | Conversion from $@ to $@ is invalid. | test.cpp:55:8:55:10 | Cat | Cat | test.cpp:60:8:60:10 | Dog | Dog |
 | test.cpp:128:24:128:59 | s2 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | Conversion from $@ to $@ is invalid. | test.cpp:102:8:102:9 | S2 | S2 | test.cpp:119:8:119:20 | Not_S2_prefix | Not_S2_prefix |
 | test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
+| test.cpp:159:14:159:33 | a | test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | Conversion from $@ to $@ is invalid. | test.cpp:60:8:60:10 | Dog | Dog | test.cpp:55:8:55:10 | Cat | Cat |

cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp

@@ -145,3 +145,29 @@ void test12() {
   HasSomeBitFields* hbf2 = reinterpret_cast<HasSomeBitFields*>(s1_2); // BAD
 }
 
+void test13(bool b, Cat* c) {
+  Animal* a;
+  if(b) {
+    a = c;
+  } else {
+    a = new Dog;
+  }
+  // This FP happens despite the `not GoodFlow::flowTo(sinkNode)` condition in the query
+  // because we don't find a flow path from `a = c` to `static_cast<Cat*>(a)` because
+  // the "source" (i.e., `a = c`) doesn't have an allocation.
+  if(b) {
+    Cat* d = static_cast<Cat*>(a); // GOOD [FALSE POSITIVE]
+  }
+}
+
+void test14(bool b) {
+  Animal* a;
+  if(b) {
+    a = new Cat;
+  } else {
+    a = new Dog;
+  }
+  if(!b) {
+    Cat* d = static_cast<Cat*>(a); // BAD [NOT DETECTED]
+  }
+}