Skip to content

Commit cc09715

Browse files
MathiasVPMathiasVP
authored
Merge pull request github#13466 from jketema/pointer-deref-fp
2 parents 04a7ff7 + 9ff5754 commit cc09715

File tree

2 files changed

+124
-0
lines changed

2 files changed

+124
-0
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -748,6 +748,46 @@ edges
748748
| test.cpp:381:5:381:9 | ... ++ | test.cpp:384:14:384:16 | end |
749749
| test.cpp:381:5:381:9 | ... ++ | test.cpp:384:14:384:16 | end |
750750
| test.cpp:384:14:384:16 | end | test.cpp:384:13:384:16 | Load: * ... |
751+
| test.cpp:388:14:388:27 | new[] | test.cpp:389:16:389:17 | xs |
752+
| test.cpp:388:14:388:27 | new[] | test.cpp:392:5:392:6 | xs |
753+
| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
754+
| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
755+
| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
756+
| test.cpp:389:16:389:17 | xs | test.cpp:392:5:392:8 | ... ++ |
757+
| test.cpp:389:16:389:17 | xs | test.cpp:393:9:393:10 | xs |
758+
| test.cpp:389:16:389:17 | xs | test.cpp:393:9:393:10 | xs |
759+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:392:5:392:8 | ... ++ |
760+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:392:5:392:8 | ... ++ |
761+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
762+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
763+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
764+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:393:9:393:10 | xs |
765+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:6 | xs |
766+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:6 | xs |
767+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
768+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
769+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
770+
| test.cpp:392:5:392:8 | ... ++ | test.cpp:395:5:395:13 | Store: ... = ... |
771+
| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:6 | xs |
772+
| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
773+
| test.cpp:393:9:393:10 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
774+
| test.cpp:395:5:395:6 | xs | test.cpp:395:5:395:13 | Store: ... = ... |
775+
| test.cpp:404:3:404:25 | ... = ... | test.cpp:404:7:404:8 | val indirection [post update] [xs] |
776+
| test.cpp:404:7:404:8 | val indirection [post update] [xs] | test.cpp:407:3:407:5 | val indirection [xs] |
777+
| test.cpp:404:12:404:25 | new[] | test.cpp:404:3:404:25 | ... = ... |
778+
| test.cpp:406:3:406:25 | ... = ... | test.cpp:406:7:406:8 | val indirection [post update] [xs] |
779+
| test.cpp:406:7:406:8 | val indirection [post update] [xs] | test.cpp:407:3:407:5 | val indirection [xs] |
780+
| test.cpp:406:12:406:25 | new[] | test.cpp:406:3:406:25 | ... = ... |
781+
| test.cpp:407:3:407:5 | val indirection [xs] | test.cpp:407:7:407:8 | xs indirection |
782+
| test.cpp:407:3:407:18 | access to array | test.cpp:407:3:407:22 | Store: ... = ... |
783+
| test.cpp:407:7:407:8 | xs | test.cpp:407:3:407:18 | access to array |
784+
| test.cpp:407:7:407:8 | xs indirection | test.cpp:407:7:407:8 | xs |
785+
| test.cpp:417:16:417:33 | new[] | test.cpp:419:7:419:8 | xs |
786+
| test.cpp:419:7:419:8 | xs | test.cpp:419:7:419:11 | access to array |
787+
| test.cpp:419:7:419:11 | access to array | test.cpp:419:7:419:15 | Store: ... = ... |
788+
| test.cpp:427:14:427:27 | new[] | test.cpp:433:5:433:6 | xs |
789+
| test.cpp:433:5:433:6 | xs | test.cpp:433:5:433:17 | access to array |
790+
| test.cpp:433:5:433:17 | access to array | test.cpp:433:5:433:21 | Store: ... = ... |
751791
nodes
752792
| test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
753793
| test.cpp:5:15:5:15 | p | semmle.label | p |
@@ -1087,6 +1127,36 @@ nodes
10871127
| test.cpp:381:5:381:9 | ... ++ | semmle.label | ... ++ |
10881128
| test.cpp:384:13:384:16 | Load: * ... | semmle.label | Load: * ... |
10891129
| test.cpp:384:14:384:16 | end | semmle.label | end |
1130+
| test.cpp:388:14:388:27 | new[] | semmle.label | new[] |
1131+
| test.cpp:389:16:389:17 | xs | semmle.label | xs |
1132+
| test.cpp:392:5:392:6 | xs | semmle.label | xs |
1133+
| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
1134+
| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
1135+
| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
1136+
| test.cpp:392:5:392:8 | ... ++ | semmle.label | ... ++ |
1137+
| test.cpp:393:9:393:10 | xs | semmle.label | xs |
1138+
| test.cpp:393:9:393:10 | xs | semmle.label | xs |
1139+
| test.cpp:395:5:395:6 | xs | semmle.label | xs |
1140+
| test.cpp:395:5:395:13 | Store: ... = ... | semmle.label | Store: ... = ... |
1141+
| test.cpp:404:3:404:25 | ... = ... | semmle.label | ... = ... |
1142+
| test.cpp:404:7:404:8 | val indirection [post update] [xs] | semmle.label | val indirection [post update] [xs] |
1143+
| test.cpp:404:12:404:25 | new[] | semmle.label | new[] |
1144+
| test.cpp:406:3:406:25 | ... = ... | semmle.label | ... = ... |
1145+
| test.cpp:406:7:406:8 | val indirection [post update] [xs] | semmle.label | val indirection [post update] [xs] |
1146+
| test.cpp:406:12:406:25 | new[] | semmle.label | new[] |
1147+
| test.cpp:407:3:407:5 | val indirection [xs] | semmle.label | val indirection [xs] |
1148+
| test.cpp:407:3:407:18 | access to array | semmle.label | access to array |
1149+
| test.cpp:407:3:407:22 | Store: ... = ... | semmle.label | Store: ... = ... |
1150+
| test.cpp:407:7:407:8 | xs | semmle.label | xs |
1151+
| test.cpp:407:7:407:8 | xs indirection | semmle.label | xs indirection |
1152+
| test.cpp:417:16:417:33 | new[] | semmle.label | new[] |
1153+
| test.cpp:419:7:419:8 | xs | semmle.label | xs |
1154+
| test.cpp:419:7:419:11 | access to array | semmle.label | access to array |
1155+
| test.cpp:419:7:419:15 | Store: ... = ... | semmle.label | Store: ... = ... |
1156+
| test.cpp:427:14:427:27 | new[] | semmle.label | new[] |
1157+
| test.cpp:433:5:433:6 | xs | semmle.label | xs |
1158+
| test.cpp:433:5:433:17 | access to array | semmle.label | access to array |
1159+
| test.cpp:433:5:433:21 | Store: ... = ... | semmle.label | Store: ... = ... |
10901160
subpaths
10911161
#select
10921162
| test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -1113,3 +1183,7 @@ subpaths
11131183
| test.cpp:359:14:359:32 | Load: * ... | test.cpp:355:14:355:27 | new[] | test.cpp:359:14:359:32 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 2. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size |
11141184
| test.cpp:372:15:372:16 | Load: * ... | test.cpp:363:14:363:27 | new[] | test.cpp:372:15:372:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:363:14:363:27 | new[] | new[] | test.cpp:365:19:365:22 | size | size |
11151185
| test.cpp:384:13:384:16 | Load: * ... | test.cpp:377:14:377:27 | new[] | test.cpp:384:13:384:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:377:14:377:27 | new[] | new[] | test.cpp:378:20:378:23 | size | size |
1186+
| test.cpp:395:5:395:13 | Store: ... = ... | test.cpp:388:14:388:27 | new[] | test.cpp:395:5:395:13 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:388:14:388:27 | new[] | new[] | test.cpp:389:19:389:22 | size | size |
1187+
| test.cpp:407:3:407:22 | Store: ... = ... | test.cpp:404:12:404:25 | new[] | test.cpp:407:3:407:22 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:404:12:404:25 | new[] | new[] | test.cpp:407:10:407:17 | ... - ... | ... - ... |
1188+
| test.cpp:419:7:419:15 | Store: ... = ... | test.cpp:417:16:417:33 | new[] | test.cpp:419:7:419:15 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:417:16:417:33 | new[] | new[] | test.cpp:419:10:419:10 | i | i |
1189+
| test.cpp:433:5:433:21 | Store: ... = ... | test.cpp:427:14:427:27 | new[] | test.cpp:433:5:433:21 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:427:14:427:27 | new[] | new[] | test.cpp:433:8:433:16 | ... ++ | ... ++ |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -383,3 +383,53 @@ void test27(unsigned size, bool b) {
383383

384384
int val = *end; // BAD
385385
}
386+
387+
void test28(unsigned size) {
388+
char *xs = new char[size];
389+
char *end = &xs[size];
390+
if (xs >= end)
391+
return;
392+
xs++;
393+
if (xs >= end)
394+
return;
395+
xs[0] = 0; // GOOD [FALSE POSITIVE]
396+
}
397+
398+
struct test29_struct {
399+
char* xs;
400+
};
401+
402+
void test29(unsigned size) {
403+
test29_struct val;
404+
val.xs = new char[size];
405+
size++;
406+
val.xs = new char[size];
407+
val.xs[size - 1] = 0; // GOOD [FALSE POSITIVE]
408+
}
409+
410+
void test30(int *size)
411+
{
412+
int new_size = 0, tmp_size = 0;
413+
414+
test30(&tmp_size);
415+
if (tmp_size + 1 > new_size) {
416+
new_size = tmp_size + 1;
417+
char *xs = new char[new_size];
418+
for (int i = 0; i < new_size; i++) {
419+
xs[i] = 0; // GOOD [FALSE POSITIVE]
420+
}
421+
}
422+
*size = new_size;
423+
}
424+
425+
void test31(unsigned size, unsigned src_pos)
426+
{
427+
char *xs = new char[size];
428+
if (src_pos > size) {
429+
src_pos = size;
430+
}
431+
unsigned dst_pos = src_pos;
432+
if(dst_pos < size - 3) {
433+
xs[dst_pos++] = 0; // GOOD [FALSE POSITIVE]
434+
}
435+
}

0 commit comments

Comments
 (0)