10
10
* external/cwe/cwe-295
11
11
*/
12
12
13
-
14
13
import cpp
15
14
import semmle.code.cpp.controlflow.Guards
16
15
import semmle.code.cpp.dataflow.DataFlow
17
16
18
17
class SSLGetVerifyResultCall extends FunctionCall {
19
- SSLGetVerifyResultCall ( ) {
20
- getTarget ( ) .getName ( ) = "SSL_get_verify_result"
21
- }
18
+ SSLGetVerifyResultCall ( ) { getTarget ( ) .getName ( ) = "SSL_get_verify_result" }
22
19
}
23
20
24
21
class VerifyResultConfig extends DataFlow:: Configuration {
@@ -29,21 +26,18 @@ class VerifyResultConfig extends DataFlow::Configuration {
29
26
}
30
27
31
28
override predicate isSink ( DataFlow:: Node sink ) {
32
- exists ( GuardCondition guard |
33
- guard .getAChild * ( ) = sink .asExpr ( )
34
- )
29
+ exists ( GuardCondition guard | guard .getAChild * ( ) = sink .asExpr ( ) )
35
30
}
36
31
}
37
32
38
33
from
39
- VerifyResultConfig config , DataFlow:: Node source , DataFlow:: Node sink1 , DataFlow:: Node sink2 ,
40
- GuardCondition guard , Expr c1 , Expr c2 , boolean testIsTrue
34
+ VerifyResultConfig config , DataFlow:: Node source , DataFlow:: Node sink1 , DataFlow:: Node sink2 ,
35
+ GuardCondition guard , Expr c1 , Expr c2 , boolean testIsTrue
41
36
where
42
- config .hasFlow ( source , sink1 ) and
43
- config .hasFlow ( source , sink2 ) and
44
- guard .comparesEq ( sink1 .asExpr ( ) , c1 , 0 , false , testIsTrue ) and // (value != c1) => testIsTrue
45
- guard .comparesEq ( sink2 .asExpr ( ) , c2 , 0 , false , testIsTrue ) and // (value != c2) => testIsTrue
46
- c1 .getValue ( ) .toInt ( ) = 0 and
47
- c2 .getValue ( ) .toInt ( ) != 0
48
- select
49
- guard , "This expression conflates OK and non-OK results from $@." , source , source .toString ( )
37
+ config .hasFlow ( source , sink1 ) and
38
+ config .hasFlow ( source , sink2 ) and
39
+ guard .comparesEq ( sink1 .asExpr ( ) , c1 , 0 , false , testIsTrue ) and // (value != c1) => testIsTrue
40
+ guard .comparesEq ( sink2 .asExpr ( ) , c2 , 0 , false , testIsTrue ) and // (value != c2) => testIsTrue
41
+ c1 .getValue ( ) .toInt ( ) = 0 and
42
+ c2 .getValue ( ) .toInt ( ) != 0
43
+ select guard , "This expression conflates OK and non-OK results from $@." , source , source .toString ( )
0 commit comments