Skip to content

Commit 014e347

Browse files
committed
Move 2020 workshop into its own folder
1 parent b4771d6 commit 014e347

File tree

6 files changed

+36
-0
lines changed

6 files changed

+36
-0
lines changed
File renamed without changes.

workshop-2020/UseAfterFree.ql

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/**
2+
* @name Use after free
3+
* @kind path-problem
4+
* @id cpp/workshop/use-after-free
5+
*/
6+
7+
import cpp
8+
9+
import semmle.code.cpp.dataflow.TaintTracking
10+
import DataFlow::PathGraph
11+
12+
13+
class Config extends DataFlow::Configuration {
14+
Config() { this = "Use after free config (doesn't matter)"}
15+
16+
override predicate isSource(DataFlow::Node arg) {
17+
exists(FunctionCall call |
18+
call.getArgument(0) = arg.asDefiningArgument() and
19+
call.getTarget().hasGlobalOrStdName("free")
20+
)
21+
}
22+
23+
override predicate isSink(DataFlow::Node sink) {
24+
dereferenced(sink.asExpr()) // depends on DataFlow1
25+
}
26+
27+
override predicate isBarrier(DataFlow::Node barrier) {
28+
none()
29+
}
30+
}
31+
32+
from DataFlow::PathNode source, DataFlow::PathNode sink, Config config
33+
where config.hasFlowPath(source, sink)
34+
select sink, source, sink,
35+
"Potential use-after-free vulnerability: memory is $@ and $@.",
36+
source, "freed here", sink, "used here"
File renamed without changes.

0 commit comments

Comments
 (0)