Skip to content

Commit 3aa1ba5

Browse files
geoffw0geoffw0
committed
C++: More additional test cases.
1 parent 8935599 commit 3aa1ba5

File tree

4 files changed

+99
-12
lines changed

4 files changed

+99
-12
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.expected

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,23 @@
8383
| tests.cpp:886:5:886:10 | call to memset | This 'memset' operation accesses 20 bytes but the $@ is only 4 bytes. | tests.cpp:833:12:833:12 | u | destination buffer |
8484
| tests.cpp:887:5:887:10 | call to memset | This 'memset' operation accesses 8 bytes but the $@ is only 4 bytes. | tests.cpp:833:12:833:12 | u | destination buffer |
8585
| tests.cpp:888:5:888:10 | call to memset | This 'memset' operation accesses 20 bytes but the $@ is only 4 bytes. | tests.cpp:833:12:833:12 | u | destination buffer |
86+
| tests.cpp:913:2:913:17 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:897:7:897:8 | as | array |
87+
| tests.cpp:915:2:915:17 | access to array | This array indexing operation accesses byte offset 399 but the $@ is only 40 bytes. | tests.cpp:897:7:897:8 | as | array |
88+
| tests.cpp:916:2:916:18 | access to array | This array indexing operation accesses byte offset 403 but the $@ is only 40 bytes. | tests.cpp:897:7:897:8 | as | array |
89+
| tests.cpp:917:2:917:17 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:897:7:897:8 | as | array |
90+
| tests.cpp:919:2:919:17 | access to array | This array indexing operation accesses byte offset 399 but the $@ is only 40 bytes. | tests.cpp:897:7:897:8 | as | array |
91+
| tests.cpp:920:2:920:18 | access to array | This array indexing operation accesses byte offset 403 but the $@ is only 40 bytes. | tests.cpp:897:7:897:8 | as | array |
92+
| tests.cpp:924:2:924:11 | access to array | This array indexing operation accesses byte offset 43 but the $@ is only 40 bytes. | tests.cpp:903:4:903:5 | ds | array |
93+
| tests.cpp:927:2:927:16 | access to array | This array indexing operation accesses byte offset 4 but the $@ is only 4 bytes. | tests.cpp:902:8:902:9 | cs | array |
94+
| tests.cpp:928:2:928:17 | access to array | This array indexing operation accesses byte offset 39 but the $@ is only 4 bytes. | tests.cpp:902:8:902:9 | cs | array |
95+
| tests.cpp:929:2:929:17 | access to array | This array indexing operation accesses byte offset 40 but the $@ is only 4 bytes. | tests.cpp:902:8:902:9 | cs | array |
96+
| tests.cpp:932:2:932:16 | access to array | This array indexing operation accesses byte offset 4 but the $@ is only 4 bytes. | tests.cpp:902:8:902:9 | cs | array |
97+
| tests.cpp:934:2:934:17 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:906:11:906:12 | xs | array |
98+
| tests.cpp:936:2:936:17 | access to array | This array indexing operation accesses byte offset 399 but the $@ is only 40 bytes. | tests.cpp:906:11:906:12 | xs | array |
99+
| tests.cpp:937:2:937:18 | access to array | This array indexing operation accesses byte offset 403 but the $@ is only 40 bytes. | tests.cpp:906:11:906:12 | xs | array |
100+
| tests.cpp:938:2:938:17 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:906:11:906:12 | xs | array |
101+
| tests.cpp:940:2:940:17 | access to array | This array indexing operation accesses byte offset 399 but the $@ is only 40 bytes. | tests.cpp:906:11:906:12 | xs | array |
102+
| tests.cpp:941:2:941:18 | access to array | This array indexing operation accesses byte offset 403 but the $@ is only 40 bytes. | tests.cpp:906:11:906:12 | xs | array |
86103
| tests_restrict.c:12:2:12:7 | call to memcpy | This 'memcpy' operation accesses 2 bytes but the $@ is only 1 byte. | tests_restrict.c:7:6:7:13 | smallbuf | source buffer |
87104
| unions.cpp:26:2:26:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:21:10:21:11 | mu | destination buffer |
88105
| unions.cpp:30:2:30:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowStatic.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,8 @@
55
| tests.cpp:245:42:245:42 | 6 | Potential buffer-overflow: 'global_array_5' has size 5 not 6. |
66
| tests.cpp:351:2:351:14 | access to array | Potential buffer-overflow: 'charArray' has size 10 but 'charArray[10]' may be accessed here. |
77
| tests.cpp:352:17:352:29 | access to array | Potential buffer-overflow: 'charArray' has size 10 but 'charArray[10]' may be accessed here. |
8+
| tests.cpp:927:2:927:16 | access to array | Potential buffer-overflow: 'cs' has size 4 but 'cs[4]' may be accessed here. |
9+
| tests.cpp:928:2:928:17 | access to array | Potential buffer-overflow: 'cs' has size 4 but 'cs[39]' may be accessed here. |
10+
| tests.cpp:929:2:929:17 | access to array | Potential buffer-overflow: 'cs' has size 4 but 'cs[40]' may be accessed here. |
11+
| tests.cpp:932:2:932:16 | access to array | Potential buffer-overflow: 'cs' has size 4 but 'cs[4]' may be accessed here. |
812
| var_size_struct.cpp:103:39:103:41 | 129 | Potential buffer-overflow: 'str' has size 128 not 129. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ edges
2727
| main.cpp:9:29:9:32 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
2828
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | **argv | provenance | |
2929
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | *argv | provenance | |
30-
| main.cpp:10:20:10:23 | **argv | tests.cpp:893:32:893:35 | **argv | provenance | |
31-
| main.cpp:10:20:10:23 | *argv | tests.cpp:893:32:893:35 | *argv | provenance | |
30+
| main.cpp:10:20:10:23 | **argv | tests.cpp:958:32:958:35 | **argv | provenance | |
31+
| main.cpp:10:20:10:23 | *argv | tests.cpp:958:32:958:35 | *argv | provenance | |
3232
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | **argv | provenance | |
3333
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | *argv | provenance | |
3434
| test_buffer_overrun.cpp:32:46:32:49 | **argv | test_buffer_overrun.cpp:32:46:32:49 | **argv | provenance | |
@@ -41,12 +41,12 @@ edges
4141
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:14:649:19 | *home | provenance | |
4242
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:16:649:19 | *home | provenance | |
4343
| tests.cpp:649:16:649:19 | *home | tests.cpp:649:14:649:19 | *home | provenance | |
44-
| tests.cpp:893:32:893:35 | **argv | tests.cpp:918:9:918:15 | *access to array | provenance | |
45-
| tests.cpp:893:32:893:35 | **argv | tests.cpp:919:9:919:15 | *access to array | provenance | |
46-
| tests.cpp:893:32:893:35 | *argv | tests.cpp:918:9:918:15 | *access to array | provenance | |
47-
| tests.cpp:893:32:893:35 | *argv | tests.cpp:919:9:919:15 | *access to array | provenance | |
48-
| tests.cpp:918:9:918:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
49-
| tests.cpp:919:9:919:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
44+
| tests.cpp:958:32:958:35 | **argv | tests.cpp:983:9:983:15 | *access to array | provenance | |
45+
| tests.cpp:958:32:958:35 | **argv | tests.cpp:984:9:984:15 | *access to array | provenance | |
46+
| tests.cpp:958:32:958:35 | *argv | tests.cpp:983:9:983:15 | *access to array | provenance | |
47+
| tests.cpp:958:32:958:35 | *argv | tests.cpp:984:9:984:15 | *access to array | provenance | |
48+
| tests.cpp:983:9:983:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
49+
| tests.cpp:984:9:984:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
5050
| tests_restrict.c:15:41:15:44 | **argv | tests_restrict.c:15:41:15:44 | **argv | provenance | |
5151
| tests_restrict.c:15:41:15:44 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
5252
nodes
@@ -80,10 +80,10 @@ nodes
8080
| tests.cpp:649:14:649:14 | *s [*home] | semmle.label | *s [*home] |
8181
| tests.cpp:649:14:649:19 | *home | semmle.label | *home |
8282
| tests.cpp:649:16:649:19 | *home | semmle.label | *home |
83-
| tests.cpp:893:32:893:35 | **argv | semmle.label | **argv |
84-
| tests.cpp:893:32:893:35 | *argv | semmle.label | *argv |
85-
| tests.cpp:918:9:918:15 | *access to array | semmle.label | *access to array |
86-
| tests.cpp:919:9:919:15 | *access to array | semmle.label | *access to array |
83+
| tests.cpp:958:32:958:35 | **argv | semmle.label | **argv |
84+
| tests.cpp:958:32:958:35 | *argv | semmle.label | *argv |
85+
| tests.cpp:983:9:983:15 | *access to array | semmle.label | *access to array |
86+
| tests.cpp:984:9:984:15 | *access to array | semmle.label | *access to array |
8787
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
8888
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
8989
| tests_restrict.c:15:41:15:44 | *argv | semmle.label | *argv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -890,6 +890,71 @@ struct S2 {
890890
}
891891
};
892892

893+
typedef int MyArray[10];
894+
895+
typedef struct _MyArrayArray {
896+
struct {
897+
int as[10];
898+
} bs[10];
899+
900+
union {
901+
int i;
902+
char cs[4];
903+
} ds[10];
904+
905+
struct {
906+
MyArray xs;
907+
} ys[10];
908+
} MyArrayArray;
909+
910+
void test26() {
911+
MyArrayArray maa;
912+
913+
maa.bs[0].as[-1] = 0; // BAD: underrun write [NOT DETECTED]
914+
maa.bs[0].as[0] = 0; // GOOD
915+
maa.bs[0].as[99] = 0; // GOOD (overflows into bs[9]) [FALSE POSITIVE]
916+
maa.bs[0].as[100] = 0; // BAD: overrun write
917+
maa.bs[1].as[-1] = 0; // GOOD (underflows into bs[0]) [FALSE POSITIVE]
918+
maa.bs[1].as[0] = 0; // GOOD
919+
maa.bs[1].as[99] = 0; // BAD: overrun write
920+
maa.bs[1].as[100] = 0; // BAD: overrun write
921+
922+
maa.ds[0].i = 0; // GOOD
923+
maa.ds[9].i = 0; // GOOD
924+
maa.ds[10].i = 0; // BAD: overrun write
925+
maa.ds[0].cs[0] = 0; // GOOD
926+
maa.ds[0].cs[3] = 0; // GOOD
927+
maa.ds[0].cs[4] = 0; // GOOD (overflows into vs[1] [FALSE POSITIVE]
928+
maa.ds[0].cs[39] = 0; // GOOD (overflows into vs[9] [FALSE POSITIVE]
929+
maa.ds[0].cs[40] = 0; // BAD: overrun write
930+
maa.ds[9].cs[0] = 0; // GOOD
931+
maa.ds[9].cs[3] = 0; // GOOD
932+
maa.ds[9].cs[4] = 0; // BAD: overrun write
933+
934+
maa.ys[0].xs[-1] = 0; // BAD: underrun write
935+
maa.ys[0].xs[0] = 0; // GOOD
936+
maa.ys[0].xs[99] = 0; // GOOD (overflows into bs[9]) [FALSE POSITIVE]
937+
maa.ys[0].xs[100] = 0; // BAD: overrun write
938+
maa.ys[1].xs[-1] = 0; // GOOD (underflows into ys[0]) [FALSE POSITIVE]
939+
maa.ys[1].xs[0] = 0; // GOOD
940+
maa.ys[1].xs[99] = 0; // BAD: overrun write
941+
maa.ys[1].xs[100] = 0; // BAD: overrun write
942+
943+
char zs[2][2];
944+
zs[0][-1] = 0; // BAD: underrun write [NOT DETECTED]
945+
zs[0][0] = 0; // GOOD
946+
zs[0][1] = 0; // GOOD
947+
zs[0][2] = 0; // GOOD
948+
zs[0][3] = 0; // GOOD
949+
zs[0][4] = 0; // BAD: overrun write [NOT DETECTED]
950+
zs[1][-3] = 0; // BAD: underrun write [NOT DETECTED]
951+
zs[1][-2] = 0; // GOOD
952+
zs[1][-1] = 0; // GOOD
953+
zs[1][0] = 0; // GOOD
954+
zs[1][1] = 0; // GOOD
955+
zs[1][2] = 0; // BAD: overrun write [NOT DETECTED]
956+
}
957+
893958
int tests_main(int argc, char *argv[])
894959
{
895960
long long arr17[19];
@@ -917,6 +982,7 @@ int tests_main(int argc, char *argv[])
917982
test23();
918983
test24(argv[0]);
919984
test25(argv[0]);
985+
test26();
920986

921987
return 0;
922988
}

0 commit comments

Comments
 (0)