Skip to content

Commit bc0b2e5

Browse files
MathiasVPMathiasVP
committed
C++: Fix the return type and parameter type of 'malloc' in test.
1 parent 6a2a029 commit bc0b2e5

File tree

2 files changed

+42
-63
lines changed

2 files changed

+42
-63
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.expected

Lines changed: 28 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
edges
2-
| test.cpp:4:15:4:20 | call to malloc | test.cpp:5:15:5:22 | ... + ... |
3-
| test.cpp:4:15:4:20 | call to malloc | test.cpp:5:15:5:22 | ... + ... |
4-
| test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | * ... |
5-
| test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | * ... |
6-
| test.cpp:4:15:4:20 | call to malloc | test.cpp:8:14:8:21 | * ... |
2+
| test.cpp:4:15:4:33 | call to malloc | test.cpp:5:15:5:22 | ... + ... |
3+
| test.cpp:4:15:4:33 | call to malloc | test.cpp:5:15:5:22 | ... + ... |
4+
| test.cpp:4:15:4:33 | call to malloc | test.cpp:6:14:6:15 | * ... |
5+
| test.cpp:4:15:4:33 | call to malloc | test.cpp:6:14:6:15 | * ... |
6+
| test.cpp:4:15:4:33 | call to malloc | test.cpp:8:14:8:21 | * ... |
77
| test.cpp:5:15:5:22 | ... + ... | test.cpp:5:15:5:22 | ... + ... |
88
| test.cpp:5:15:5:22 | ... + ... | test.cpp:6:14:6:15 | * ... |
99
| test.cpp:5:15:5:22 | ... + ... | test.cpp:6:14:6:15 | * ... |
@@ -12,12 +12,12 @@ edges
1212
| test.cpp:5:15:5:22 | ... + ... | test.cpp:8:14:8:21 | * ... |
1313
| test.cpp:5:15:5:22 | ... + ... | test.cpp:8:14:8:21 | * ... |
1414
| test.cpp:6:14:6:15 | * ... | test.cpp:8:14:8:21 | * ... |
15-
| test.cpp:16:15:16:20 | call to malloc | test.cpp:20:14:20:21 | * ... |
16-
| test.cpp:28:15:28:20 | call to malloc | test.cpp:29:15:29:28 | ... + ... |
17-
| test.cpp:28:15:28:20 | call to malloc | test.cpp:29:15:29:28 | ... + ... |
18-
| test.cpp:28:15:28:20 | call to malloc | test.cpp:30:14:30:15 | * ... |
19-
| test.cpp:28:15:28:20 | call to malloc | test.cpp:30:14:30:15 | * ... |
20-
| test.cpp:28:15:28:20 | call to malloc | test.cpp:32:14:32:21 | * ... |
15+
| test.cpp:16:15:16:33 | call to malloc | test.cpp:20:14:20:21 | * ... |
16+
| test.cpp:28:15:28:37 | call to malloc | test.cpp:29:15:29:28 | ... + ... |
17+
| test.cpp:28:15:28:37 | call to malloc | test.cpp:29:15:29:28 | ... + ... |
18+
| test.cpp:28:15:28:37 | call to malloc | test.cpp:30:14:30:15 | * ... |
19+
| test.cpp:28:15:28:37 | call to malloc | test.cpp:30:14:30:15 | * ... |
20+
| test.cpp:28:15:28:37 | call to malloc | test.cpp:32:14:32:21 | * ... |
2121
| test.cpp:29:15:29:28 | ... + ... | test.cpp:29:15:29:28 | ... + ... |
2222
| test.cpp:29:15:29:28 | ... + ... | test.cpp:30:14:30:15 | * ... |
2323
| test.cpp:29:15:29:28 | ... + ... | test.cpp:30:14:30:15 | * ... |
@@ -26,22 +26,9 @@ edges
2626
| test.cpp:29:15:29:28 | ... + ... | test.cpp:32:14:32:21 | * ... |
2727
| test.cpp:29:15:29:28 | ... + ... | test.cpp:32:14:32:21 | * ... |
2828
| test.cpp:30:14:30:15 | * ... | test.cpp:32:14:32:21 | * ... |
29-
| test.cpp:40:15:40:20 | call to malloc | test.cpp:41:15:41:28 | ... + ... |
30-
| test.cpp:40:15:40:20 | call to malloc | test.cpp:41:15:41:28 | ... + ... |
31-
| test.cpp:40:15:40:20 | call to malloc | test.cpp:42:14:42:15 | * ... |
32-
| test.cpp:40:15:40:20 | call to malloc | test.cpp:42:14:42:15 | * ... |
33-
| test.cpp:40:15:40:20 | call to malloc | test.cpp:44:14:44:21 | * ... |
34-
| test.cpp:41:15:41:28 | ... + ... | test.cpp:41:15:41:28 | ... + ... |
35-
| test.cpp:41:15:41:28 | ... + ... | test.cpp:42:14:42:15 | * ... |
36-
| test.cpp:41:15:41:28 | ... + ... | test.cpp:42:14:42:15 | * ... |
37-
| test.cpp:41:15:41:28 | ... + ... | test.cpp:42:14:42:15 | * ... |
38-
| test.cpp:41:15:41:28 | ... + ... | test.cpp:42:14:42:15 | * ... |
39-
| test.cpp:41:15:41:28 | ... + ... | test.cpp:44:14:44:21 | * ... |
40-
| test.cpp:41:15:41:28 | ... + ... | test.cpp:44:14:44:21 | * ... |
41-
| test.cpp:42:14:42:15 | * ... | test.cpp:44:14:44:21 | * ... |
4229
| test.cpp:51:33:51:35 | end | test.cpp:60:34:60:37 | mk_array output argument |
43-
| test.cpp:52:19:52:24 | call to malloc | test.cpp:53:5:53:23 | ... = ... |
44-
| test.cpp:52:19:52:24 | call to malloc | test.cpp:53:12:53:23 | ... + ... |
30+
| test.cpp:52:19:52:37 | call to malloc | test.cpp:53:5:53:23 | ... = ... |
31+
| test.cpp:52:19:52:37 | call to malloc | test.cpp:53:12:53:23 | ... + ... |
4532
| test.cpp:53:5:53:23 | ... = ... | test.cpp:51:33:51:35 | end |
4633
| test.cpp:53:12:53:23 | ... + ... | test.cpp:53:5:53:23 | ... = ... |
4734
| test.cpp:60:34:60:37 | mk_array output argument | test.cpp:67:9:67:14 | ... = ... |
@@ -183,8 +170,8 @@ edges
183170
| test.cpp:781:14:781:27 | new[] | test.cpp:786:18:786:27 | access to array |
184171
| test.cpp:792:60:792:62 | end | test.cpp:800:40:800:43 | mk_array_no_field_flow output argument |
185172
| test.cpp:792:60:792:62 | end | test.cpp:832:40:832:43 | mk_array_no_field_flow output argument |
186-
| test.cpp:793:14:793:19 | call to malloc | test.cpp:794:5:794:24 | ... = ... |
187-
| test.cpp:793:14:793:19 | call to malloc | test.cpp:794:12:794:24 | ... + ... |
173+
| test.cpp:793:14:793:32 | call to malloc | test.cpp:794:5:794:24 | ... = ... |
174+
| test.cpp:793:14:793:32 | call to malloc | test.cpp:794:12:794:24 | ... + ... |
188175
| test.cpp:794:5:794:24 | ... = ... | test.cpp:792:60:792:62 | end |
189176
| test.cpp:794:12:794:24 | ... + ... | test.cpp:794:5:794:24 | ... = ... |
190177
| test.cpp:800:40:800:43 | mk_array_no_field_flow output argument | test.cpp:807:7:807:12 | ... = ... |
@@ -194,28 +181,22 @@ edges
194181
| test.cpp:832:40:832:43 | mk_array_no_field_flow output argument | test.cpp:833:37:833:39 | end |
195182
| test.cpp:833:37:833:39 | end | test.cpp:815:52:815:54 | end |
196183
nodes
197-
| test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
184+
| test.cpp:4:15:4:33 | call to malloc | semmle.label | call to malloc |
198185
| test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... |
199186
| test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... |
200187
| test.cpp:6:14:6:15 | * ... | semmle.label | * ... |
201188
| test.cpp:6:14:6:15 | * ... | semmle.label | * ... |
202189
| test.cpp:8:14:8:21 | * ... | semmle.label | * ... |
203-
| test.cpp:16:15:16:20 | call to malloc | semmle.label | call to malloc |
190+
| test.cpp:16:15:16:33 | call to malloc | semmle.label | call to malloc |
204191
| test.cpp:20:14:20:21 | * ... | semmle.label | * ... |
205-
| test.cpp:28:15:28:20 | call to malloc | semmle.label | call to malloc |
192+
| test.cpp:28:15:28:37 | call to malloc | semmle.label | call to malloc |
206193
| test.cpp:29:15:29:28 | ... + ... | semmle.label | ... + ... |
207194
| test.cpp:29:15:29:28 | ... + ... | semmle.label | ... + ... |
208195
| test.cpp:30:14:30:15 | * ... | semmle.label | * ... |
209196
| test.cpp:30:14:30:15 | * ... | semmle.label | * ... |
210197
| test.cpp:32:14:32:21 | * ... | semmle.label | * ... |
211-
| test.cpp:40:15:40:20 | call to malloc | semmle.label | call to malloc |
212-
| test.cpp:41:15:41:28 | ... + ... | semmle.label | ... + ... |
213-
| test.cpp:41:15:41:28 | ... + ... | semmle.label | ... + ... |
214-
| test.cpp:42:14:42:15 | * ... | semmle.label | * ... |
215-
| test.cpp:42:14:42:15 | * ... | semmle.label | * ... |
216-
| test.cpp:44:14:44:21 | * ... | semmle.label | * ... |
217198
| test.cpp:51:33:51:35 | end | semmle.label | end |
218-
| test.cpp:52:19:52:24 | call to malloc | semmle.label | call to malloc |
199+
| test.cpp:52:19:52:37 | call to malloc | semmle.label | call to malloc |
219200
| test.cpp:53:5:53:23 | ... = ... | semmle.label | ... = ... |
220201
| test.cpp:53:12:53:23 | ... + ... | semmle.label | ... + ... |
221202
| test.cpp:60:34:60:37 | mk_array output argument | semmle.label | mk_array output argument |
@@ -313,7 +294,7 @@ nodes
313294
| test.cpp:781:14:781:27 | new[] | semmle.label | new[] |
314295
| test.cpp:786:18:786:27 | access to array | semmle.label | access to array |
315296
| test.cpp:792:60:792:62 | end | semmle.label | end |
316-
| test.cpp:793:14:793:19 | call to malloc | semmle.label | call to malloc |
297+
| test.cpp:793:14:793:32 | call to malloc | semmle.label | call to malloc |
317298
| test.cpp:794:5:794:24 | ... = ... | semmle.label | ... = ... |
318299
| test.cpp:794:12:794:24 | ... + ... | semmle.label | ... + ... |
319300
| test.cpp:800:40:800:43 | mk_array_no_field_flow output argument | semmle.label | mk_array_no_field_flow output argument |
@@ -325,14 +306,12 @@ nodes
325306
| test.cpp:833:37:833:39 | end | semmle.label | end |
326307
subpaths
327308
#select
328-
| test.cpp:6:14:6:15 | * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
329-
| test.cpp:8:14:8:21 | * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:8:14:8:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
330-
| test.cpp:20:14:20:21 | * ... | test.cpp:16:15:16:20 | call to malloc | test.cpp:20:14:20:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:16:15:16:20 | call to malloc | call to malloc | test.cpp:17:19:17:22 | size | size |
331-
| test.cpp:30:14:30:15 | * ... | test.cpp:28:15:28:20 | call to malloc | test.cpp:30:14:30:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:28:15:28:20 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... |
332-
| test.cpp:32:14:32:21 | * ... | test.cpp:28:15:28:20 | call to malloc | test.cpp:32:14:32:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:28:15:28:20 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... |
333-
| test.cpp:42:14:42:15 | * ... | test.cpp:40:15:40:20 | call to malloc | test.cpp:42:14:42:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:40:15:40:20 | call to malloc | call to malloc | test.cpp:41:20:41:27 | ... - ... | ... - ... |
334-
| test.cpp:44:14:44:21 | * ... | test.cpp:40:15:40:20 | call to malloc | test.cpp:44:14:44:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:40:15:40:20 | call to malloc | call to malloc | test.cpp:41:20:41:27 | ... - ... | ... - ... |
335-
| test.cpp:67:9:67:14 | ... = ... | test.cpp:52:19:52:24 | call to malloc | test.cpp:67:9:67:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:52:19:52:24 | call to malloc | call to malloc | test.cpp:53:20:53:23 | size | size |
309+
| test.cpp:6:14:6:15 | * ... | test.cpp:4:15:4:33 | call to malloc | test.cpp:6:14:6:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:33 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
310+
| test.cpp:8:14:8:21 | * ... | test.cpp:4:15:4:33 | call to malloc | test.cpp:8:14:8:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:4:15:4:33 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
311+
| test.cpp:20:14:20:21 | * ... | test.cpp:16:15:16:33 | call to malloc | test.cpp:20:14:20:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:16:15:16:33 | call to malloc | call to malloc | test.cpp:17:19:17:22 | size | size |
312+
| test.cpp:30:14:30:15 | * ... | test.cpp:28:15:28:37 | call to malloc | test.cpp:30:14:30:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:28:15:28:37 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... |
313+
| test.cpp:32:14:32:21 | * ... | test.cpp:28:15:28:37 | call to malloc | test.cpp:32:14:32:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:28:15:28:37 | call to malloc | call to malloc | test.cpp:29:20:29:27 | ... + ... | ... + ... |
314+
| test.cpp:67:9:67:14 | ... = ... | test.cpp:52:19:52:37 | call to malloc | test.cpp:67:9:67:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:52:19:52:37 | call to malloc | call to malloc | test.cpp:53:20:53:23 | size | size |
336315
| test.cpp:201:5:201:19 | ... = ... | test.cpp:194:15:194:33 | call to malloc | test.cpp:201:5:201:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:194:15:194:33 | call to malloc | call to malloc | test.cpp:195:21:195:23 | len | len |
337316
| test.cpp:213:5:213:13 | ... = ... | test.cpp:205:15:205:33 | call to malloc | test.cpp:213:5:213:13 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:205:15:205:33 | call to malloc | call to malloc | test.cpp:206:21:206:23 | len | len |
338317
| test.cpp:232:3:232:20 | ... = ... | test.cpp:231:18:231:30 | new[] | test.cpp:232:3:232:20 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:231:18:231:30 | new[] | new[] | test.cpp:232:11:232:15 | index | index |
@@ -359,5 +338,5 @@ subpaths
359338
| test.cpp:772:16:772:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:767:22:767:28 | ... + ... | ... + ... |
360339
| test.cpp:772:16:772:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:772:22:772:28 | ... + ... | ... + ... |
361340
| test.cpp:786:18:786:27 | access to array | test.cpp:781:14:781:27 | new[] | test.cpp:786:18:786:27 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:781:14:781:27 | new[] | new[] | test.cpp:786:20:786:26 | ... + ... | ... + ... |
362-
| test.cpp:807:7:807:12 | ... = ... | test.cpp:793:14:793:19 | call to malloc | test.cpp:807:7:807:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:19 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size |
363-
| test.cpp:821:7:821:12 | ... = ... | test.cpp:793:14:793:19 | call to malloc | test.cpp:821:7:821:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:19 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size |
341+
| test.cpp:807:7:807:12 | ... = ... | test.cpp:793:14:793:32 | call to malloc | test.cpp:807:7:807:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:32 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size |
342+
| test.cpp:821:7:821:12 | ... = ... | test.cpp:793:14:793:32 | call to malloc | test.cpp:821:7:821:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:32 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size |

‎cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
char *malloc(int size);
1+
void* malloc(unsigned long size);
22

33
void test1(int size) {
4-
char* p = malloc(size);
4+
char* p = (char*)malloc(size);
55
char* q = p + size; // $ alloc=L4
66
char a = *q; // $ deref=L6 // BAD
77
char b = *(q - 1); // GOOD
@@ -13,7 +13,7 @@ void test1(int size) {
1313
}
1414

1515
void test2(int size) {
16-
char* p = malloc(size);
16+
char* p = (char*)malloc(size);
1717
char* q = p + size - 1; // $ alloc=L16
1818
char a = *q; // GOOD
1919
char b = *(q - 1); // GOOD
@@ -25,7 +25,7 @@ void test2(int size) {
2525
}
2626

2727
void test3(int size) {
28-
char* p = malloc(size + 1);
28+
char* p = (char*)malloc(size + 1);
2929
char* q = p + (size + 1); // $ alloc=L28+1
3030
char a = *q; // $ deref=L30 // BAD
3131
char b = *(q - 1); // GOOD
@@ -37,19 +37,19 @@ void test3(int size) {
3737
}
3838

3939
void test4(int size) {
40-
char* p = malloc(size - 1);
41-
char* q = p + (size - 1); // $ alloc=L40-1
42-
char a = *q; // $ deref=L42 // BAD
40+
char* p = (char*)malloc(size - 1);
41+
char* q = p + (size - 1); // $ MISSING: alloc=L40-1
42+
char a = *q; // $ MISSING: deref=L42 // BAD [NOT DETECTED]
4343
char b = *(q - 1); // GOOD
44-
char c = *(q + 1); // $ deref=L44+1 // BAD
44+
char c = *(q + 1); // $ MISSING: deref=L44+1 // BAD [NOT DETECTED]
4545
char d = *(q + size); // BAD [NOT DETECTED]
4646
char e = *(q - size); // GOOD
4747
char f = *(q + size + 1); // BAD [NOT DETECTED]
4848
char g = *(q - size - 1); // GOOD
4949
}
5050

5151
char* mk_array(int size, char** end) {
52-
char* begin = malloc(size);
52+
char* begin = (char*)malloc(size);
5353
*end = begin + size; // $ alloc=L52
5454

5555
return begin;
@@ -79,7 +79,7 @@ struct array_t {
7979

8080
array_t mk_array(int size) {
8181
array_t arr;
82-
arr.begin = malloc(size);
82+
arr.begin = (char*)malloc(size);
8383
arr.end = arr.begin + size; // $ MISSING: alloc=L82
8484

8585
return arr;
@@ -121,7 +121,7 @@ void test7(int size) {
121121

122122
void test8(int size) {
123123
array_t arr;
124-
char* p = malloc(size);
124+
char* p = (char*)malloc(size);
125125
arr.begin = p;
126126
arr.end = p + size; // $ alloc=L124
127127

@@ -140,7 +140,7 @@ void test8(int size) {
140140

141141
array_t *mk_array_p(int size) {
142142
array_t *arr = (array_t*) malloc(sizeof(array_t));
143-
arr->begin = malloc(size);
143+
arr->begin = (char*)malloc(size);
144144
arr->end = arr->begin + size; // $ MISSING: alloc=L143
145145

146146
return arr;
@@ -185,7 +185,7 @@ void deref_plus_one(char* q) {
185185
}
186186

187187
void test11(unsigned size) {
188-
char *p = malloc(size);
188+
char *p = (char*)malloc(size);
189189
char *q = p + size - 1; // $ alloc=L188
190190
deref_plus_one(q);
191191
}
@@ -790,7 +790,7 @@ void test38_simple(unsigned size, unsigned pos, unsigned numParams) {
790790
}
791791

792792
void mk_array_no_field_flow(int size, char** begin, char** end) {
793-
*begin = malloc(size);
793+
*begin = (char*)malloc(size);
794794
*end = *begin + size; // $ alloc=L793
795795
}
796796

0 commit comments

Comments
 (0)