Skip to content

Commit 68dfca4

Browse files
paldepindpaldepind
authored
Merge pull request #17269 from paldepind/fix-error-in-test
C++: Fix tests and add an actual true negative
2 parents 6103749 + e4ce003 commit 68dfca4

File tree

2 files changed

+61
-55
lines changed

2 files changed

+61
-55
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

Lines changed: 54 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -13,26 +13,26 @@ edges
1313
| test.cpp:133:19:133:32 | *call to getenv | test.cpp:133:14:133:17 | call to atoi | provenance | TaintFunction |
1414
| test.cpp:148:15:148:18 | call to atol | test.cpp:152:11:152:28 | ... * ... | provenance | |
1515
| test.cpp:148:20:148:33 | *call to getenv | test.cpp:148:15:148:18 | call to atol | provenance | TaintFunction |
16-
| test.cpp:218:8:218:23 | *get_tainted_size | test.cpp:250:9:250:24 | call to get_tainted_size | provenance | |
17-
| test.cpp:220:9:220:42 | ... * ... | test.cpp:218:8:218:23 | *get_tainted_size | provenance | |
18-
| test.cpp:220:14:220:27 | *call to getenv | test.cpp:220:9:220:42 | ... * ... | provenance | TaintFunction |
19-
| test.cpp:239:21:239:21 | s | test.cpp:240:21:240:21 | s | provenance | |
20-
| test.cpp:246:19:246:52 | ... * ... | test.cpp:248:9:248:18 | local_size | provenance | |
21-
| test.cpp:246:19:246:52 | ... * ... | test.cpp:254:11:254:20 | local_size | provenance | |
22-
| test.cpp:246:19:246:52 | ... * ... | test.cpp:256:10:256:19 | local_size | provenance | |
23-
| test.cpp:246:24:246:37 | *call to getenv | test.cpp:246:19:246:52 | ... * ... | provenance | TaintFunction |
24-
| test.cpp:256:10:256:19 | local_size | test.cpp:239:21:239:21 | s | provenance | |
25-
| test.cpp:259:20:259:27 | *out_size | test.cpp:298:17:298:20 | get_size output argument | provenance | |
26-
| test.cpp:259:20:259:27 | *out_size | test.cpp:314:18:314:21 | get_size output argument | provenance | |
27-
| test.cpp:260:2:260:32 | ... = ... | test.cpp:259:20:259:27 | *out_size | provenance | |
28-
| test.cpp:260:18:260:31 | *call to getenv | test.cpp:260:2:260:32 | ... = ... | provenance | TaintFunction |
29-
| test.cpp:268:15:268:18 | call to atoi | test.cpp:272:11:272:29 | ... * ... | provenance | |
30-
| test.cpp:268:20:268:33 | *call to getenv | test.cpp:268:15:268:18 | call to atoi | provenance | TaintFunction |
31-
| test.cpp:298:17:298:20 | get_size output argument | test.cpp:300:11:300:28 | ... * ... | provenance | |
32-
| test.cpp:314:18:314:21 | get_size output argument | test.cpp:317:10:317:27 | ... * ... | provenance | |
33-
| test.cpp:362:13:362:16 | call to atoi | test.cpp:364:35:364:38 | size | provenance | |
34-
| test.cpp:362:13:362:16 | call to atoi | test.cpp:365:35:365:38 | size | provenance | |
35-
| test.cpp:362:18:362:31 | *call to getenv | test.cpp:362:13:362:16 | call to atoi | provenance | TaintFunction |
16+
| test.cpp:224:8:224:23 | *get_tainted_size | test.cpp:256:9:256:24 | call to get_tainted_size | provenance | |
17+
| test.cpp:226:9:226:42 | ... * ... | test.cpp:224:8:224:23 | *get_tainted_size | provenance | |
18+
| test.cpp:226:14:226:27 | *call to getenv | test.cpp:226:9:226:42 | ... * ... | provenance | TaintFunction |
19+
| test.cpp:245:21:245:21 | s | test.cpp:246:21:246:21 | s | provenance | |
20+
| test.cpp:252:19:252:52 | ... * ... | test.cpp:254:9:254:18 | local_size | provenance | |
21+
| test.cpp:252:19:252:52 | ... * ... | test.cpp:260:11:260:20 | local_size | provenance | |
22+
| test.cpp:252:19:252:52 | ... * ... | test.cpp:262:10:262:19 | local_size | provenance | |
23+
| test.cpp:252:24:252:37 | *call to getenv | test.cpp:252:19:252:52 | ... * ... | provenance | TaintFunction |
24+
| test.cpp:262:10:262:19 | local_size | test.cpp:245:21:245:21 | s | provenance | |
25+
| test.cpp:265:20:265:27 | *out_size | test.cpp:304:17:304:20 | get_size output argument | provenance | |
26+
| test.cpp:265:20:265:27 | *out_size | test.cpp:320:18:320:21 | get_size output argument | provenance | |
27+
| test.cpp:266:2:266:32 | ... = ... | test.cpp:265:20:265:27 | *out_size | provenance | |
28+
| test.cpp:266:18:266:31 | *call to getenv | test.cpp:266:2:266:32 | ... = ... | provenance | TaintFunction |
29+
| test.cpp:274:15:274:18 | call to atoi | test.cpp:278:11:278:29 | ... * ... | provenance | |
30+
| test.cpp:274:20:274:33 | *call to getenv | test.cpp:274:15:274:18 | call to atoi | provenance | TaintFunction |
31+
| test.cpp:304:17:304:20 | get_size output argument | test.cpp:306:11:306:28 | ... * ... | provenance | |
32+
| test.cpp:320:18:320:21 | get_size output argument | test.cpp:323:10:323:27 | ... * ... | provenance | |
33+
| test.cpp:368:13:368:16 | call to atoi | test.cpp:370:35:370:38 | size | provenance | |
34+
| test.cpp:368:13:368:16 | call to atoi | test.cpp:371:35:371:38 | size | provenance | |
35+
| test.cpp:368:18:368:31 | *call to getenv | test.cpp:368:13:368:16 | call to atoi | provenance | TaintFunction |
3636
nodes
3737
| test.cpp:39:27:39:30 | **argv | semmle.label | **argv |
3838
| test.cpp:40:16:40:19 | call to atoi | semmle.label | call to atoi |
@@ -52,31 +52,31 @@ nodes
5252
| test.cpp:148:15:148:18 | call to atol | semmle.label | call to atol |
5353
| test.cpp:148:20:148:33 | *call to getenv | semmle.label | *call to getenv |
5454
| test.cpp:152:11:152:28 | ... * ... | semmle.label | ... * ... |
55-
| test.cpp:218:8:218:23 | *get_tainted_size | semmle.label | *get_tainted_size |
56-
| test.cpp:220:9:220:42 | ... * ... | semmle.label | ... * ... |
57-
| test.cpp:220:14:220:27 | *call to getenv | semmle.label | *call to getenv |
58-
| test.cpp:239:21:239:21 | s | semmle.label | s |
59-
| test.cpp:240:21:240:21 | s | semmle.label | s |
60-
| test.cpp:246:19:246:52 | ... * ... | semmle.label | ... * ... |
61-
| test.cpp:246:24:246:37 | *call to getenv | semmle.label | *call to getenv |
62-
| test.cpp:248:9:248:18 | local_size | semmle.label | local_size |
63-
| test.cpp:250:9:250:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
64-
| test.cpp:254:11:254:20 | local_size | semmle.label | local_size |
65-
| test.cpp:256:10:256:19 | local_size | semmle.label | local_size |
66-
| test.cpp:259:20:259:27 | *out_size | semmle.label | *out_size |
67-
| test.cpp:260:2:260:32 | ... = ... | semmle.label | ... = ... |
68-
| test.cpp:260:18:260:31 | *call to getenv | semmle.label | *call to getenv |
69-
| test.cpp:268:15:268:18 | call to atoi | semmle.label | call to atoi |
70-
| test.cpp:268:20:268:33 | *call to getenv | semmle.label | *call to getenv |
71-
| test.cpp:272:11:272:29 | ... * ... | semmle.label | ... * ... |
72-
| test.cpp:298:17:298:20 | get_size output argument | semmle.label | get_size output argument |
73-
| test.cpp:300:11:300:28 | ... * ... | semmle.label | ... * ... |
74-
| test.cpp:314:18:314:21 | get_size output argument | semmle.label | get_size output argument |
75-
| test.cpp:317:10:317:27 | ... * ... | semmle.label | ... * ... |
76-
| test.cpp:362:13:362:16 | call to atoi | semmle.label | call to atoi |
77-
| test.cpp:362:18:362:31 | *call to getenv | semmle.label | *call to getenv |
78-
| test.cpp:364:35:364:38 | size | semmle.label | size |
79-
| test.cpp:365:35:365:38 | size | semmle.label | size |
55+
| test.cpp:224:8:224:23 | *get_tainted_size | semmle.label | *get_tainted_size |
56+
| test.cpp:226:9:226:42 | ... * ... | semmle.label | ... * ... |
57+
| test.cpp:226:14:226:27 | *call to getenv | semmle.label | *call to getenv |
58+
| test.cpp:245:21:245:21 | s | semmle.label | s |
59+
| test.cpp:246:21:246:21 | s | semmle.label | s |
60+
| test.cpp:252:19:252:52 | ... * ... | semmle.label | ... * ... |
61+
| test.cpp:252:24:252:37 | *call to getenv | semmle.label | *call to getenv |
62+
| test.cpp:254:9:254:18 | local_size | semmle.label | local_size |
63+
| test.cpp:256:9:256:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
64+
| test.cpp:260:11:260:20 | local_size | semmle.label | local_size |
65+
| test.cpp:262:10:262:19 | local_size | semmle.label | local_size |
66+
| test.cpp:265:20:265:27 | *out_size | semmle.label | *out_size |
67+
| test.cpp:266:2:266:32 | ... = ... | semmle.label | ... = ... |
68+
| test.cpp:266:18:266:31 | *call to getenv | semmle.label | *call to getenv |
69+
| test.cpp:274:15:274:18 | call to atoi | semmle.label | call to atoi |
70+
| test.cpp:274:20:274:33 | *call to getenv | semmle.label | *call to getenv |
71+
| test.cpp:278:11:278:29 | ... * ... | semmle.label | ... * ... |
72+
| test.cpp:304:17:304:20 | get_size output argument | semmle.label | get_size output argument |
73+
| test.cpp:306:11:306:28 | ... * ... | semmle.label | ... * ... |
74+
| test.cpp:320:18:320:21 | get_size output argument | semmle.label | get_size output argument |
75+
| test.cpp:323:10:323:27 | ... * ... | semmle.label | ... * ... |
76+
| test.cpp:368:13:368:16 | call to atoi | semmle.label | call to atoi |
77+
| test.cpp:368:18:368:31 | *call to getenv | semmle.label | *call to getenv |
78+
| test.cpp:370:35:370:38 | size | semmle.label | size |
79+
| test.cpp:371:35:371:38 | size | semmle.label | size |
8080
subpaths
8181
#select
8282
| test.cpp:43:31:43:36 | call to malloc | test.cpp:39:27:39:30 | **argv | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:39:27:39:30 | **argv | user input (a command-line argument) |
@@ -88,12 +88,12 @@ subpaths
8888
| test.cpp:128:17:128:22 | call to malloc | test.cpp:124:18:124:31 | *call to getenv | test.cpp:128:24:128:41 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:124:18:124:31 | *call to getenv | user input (an environment variable) |
8989
| test.cpp:135:3:135:8 | call to malloc | test.cpp:133:19:133:32 | *call to getenv | test.cpp:135:10:135:27 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:133:19:133:32 | *call to getenv | user input (an environment variable) |
9090
| test.cpp:152:4:152:9 | call to malloc | test.cpp:148:20:148:33 | *call to getenv | test.cpp:152:11:152:28 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:148:20:148:33 | *call to getenv | user input (an environment variable) |
91-
| test.cpp:240:14:240:19 | call to malloc | test.cpp:246:24:246:37 | *call to getenv | test.cpp:240:21:240:21 | s | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:246:24:246:37 | *call to getenv | user input (an environment variable) |
92-
| test.cpp:248:2:248:7 | call to malloc | test.cpp:246:24:246:37 | *call to getenv | test.cpp:248:9:248:18 | local_size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:246:24:246:37 | *call to getenv | user input (an environment variable) |
93-
| test.cpp:250:2:250:7 | call to malloc | test.cpp:220:14:220:27 | *call to getenv | test.cpp:250:9:250:24 | call to get_tainted_size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:220:14:220:27 | *call to getenv | user input (an environment variable) |
94-
| test.cpp:254:2:254:9 | call to my_alloc | test.cpp:246:24:246:37 | *call to getenv | test.cpp:254:11:254:20 | local_size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:246:24:246:37 | *call to getenv | user input (an environment variable) |
95-
| test.cpp:272:4:272:9 | call to malloc | test.cpp:268:20:268:33 | *call to getenv | test.cpp:272:11:272:29 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:268:20:268:33 | *call to getenv | user input (an environment variable) |
96-
| test.cpp:300:4:300:9 | call to malloc | test.cpp:260:18:260:31 | *call to getenv | test.cpp:300:11:300:28 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:260:18:260:31 | *call to getenv | user input (an environment variable) |
97-
| test.cpp:317:3:317:8 | call to malloc | test.cpp:260:18:260:31 | *call to getenv | test.cpp:317:10:317:27 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:260:18:260:31 | *call to getenv | user input (an environment variable) |
98-
| test.cpp:364:25:364:33 | call to MyMalloc1 | test.cpp:362:18:362:31 | *call to getenv | test.cpp:364:35:364:38 | size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:362:18:362:31 | *call to getenv | user input (an environment variable) |
99-
| test.cpp:365:25:365:33 | call to MyMalloc2 | test.cpp:362:18:362:31 | *call to getenv | test.cpp:365:35:365:38 | size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:362:18:362:31 | *call to getenv | user input (an environment variable) |
91+
| test.cpp:246:14:246:19 | call to malloc | test.cpp:252:24:252:37 | *call to getenv | test.cpp:246:21:246:21 | s | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:252:24:252:37 | *call to getenv | user input (an environment variable) |
92+
| test.cpp:254:2:254:7 | call to malloc | test.cpp:252:24:252:37 | *call to getenv | test.cpp:254:9:254:18 | local_size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:252:24:252:37 | *call to getenv | user input (an environment variable) |
93+
| test.cpp:256:2:256:7 | call to malloc | test.cpp:226:14:226:27 | *call to getenv | test.cpp:256:9:256:24 | call to get_tainted_size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:226:14:226:27 | *call to getenv | user input (an environment variable) |
94+
| test.cpp:260:2:260:9 | call to my_alloc | test.cpp:252:24:252:37 | *call to getenv | test.cpp:260:11:260:20 | local_size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:252:24:252:37 | *call to getenv | user input (an environment variable) |
95+
| test.cpp:278:4:278:9 | call to malloc | test.cpp:274:20:274:33 | *call to getenv | test.cpp:278:11:278:29 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:274:20:274:33 | *call to getenv | user input (an environment variable) |
96+
| test.cpp:306:4:306:9 | call to malloc | test.cpp:266:18:266:31 | *call to getenv | test.cpp:306:11:306:28 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:266:18:266:31 | *call to getenv | user input (an environment variable) |
97+
| test.cpp:323:3:323:8 | call to malloc | test.cpp:266:18:266:31 | *call to getenv | test.cpp:323:10:323:27 | ... * ... | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:266:18:266:31 | *call to getenv | user input (an environment variable) |
98+
| test.cpp:370:25:370:33 | call to MyMalloc1 | test.cpp:368:18:368:31 | *call to getenv | test.cpp:370:35:370:38 | size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:368:18:368:31 | *call to getenv | user input (an environment variable) |
99+
| test.cpp:371:25:371:33 | call to MyMalloc2 | test.cpp:368:18:368:31 | *call to getenv | test.cpp:371:35:371:38 | size | This allocation size is derived from $@ and could allocate arbitrary amounts of memory. | test.cpp:368:18:368:31 | *call to getenv | user input (an environment variable) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -180,12 +180,18 @@ void more_bounded_tests() {
180180
}
181181
}
182182

183+
{
184+
int size = atoi(getenv("USER"));
185+
int size2 = size % 100;
186+
malloc(size2 * sizeof(int)); // GOOD
187+
}
188+
183189
{
184190
int size = atoi(getenv("USER"));
185191

186192
if (size % 100)
187193
{
188-
malloc(size * sizeof(int)); // GOOD
194+
malloc(size * sizeof(int)); // BAD [NOT DETECTED]
189195
}
190196
}
191197

0 commit comments

Comments
 (0)