Skip to content

Commit 17df8e4

Browse files
MathiasVPMathiasVP
committed
C++: Convert 'cpp/tainted-arithmetic' to a 'path-problem' query.
1 parent 64001cc commit 17df8e4

File tree

2 files changed

+97
-26
lines changed

2 files changed

+97
-26
lines changed

‎cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql

Lines changed: 29 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
* @name User-controlled data in arithmetic expression
33
* @description Arithmetic operations on user-controlled data that is
44
* not validated can cause overflows.
5-
* @kind problem
5+
* @kind path-problem
66
* @problem.severity warning
77
* @security-severity 5.9
88
* @precision low
@@ -16,22 +16,34 @@ import cpp
1616
import semmle.code.cpp.security.Overflow
1717
import semmle.code.cpp.security.Security
1818
import semmle.code.cpp.security.TaintTracking
19+
import TaintedWithPath
1920

20-
from Expr origin, Operation op, Expr e, string effect
21+
bindingset[op]
22+
predicate missingGuard(Operation op, Expr e, string effect) {
23+
missingGuardAgainstUnderflow(op, e) and effect = "underflow"
24+
or
25+
missingGuardAgainstOverflow(op, e) and effect = "overflow"
26+
or
27+
not e instanceof VariableAccess and effect = "overflow"
28+
}
29+
30+
class Configuration extends TaintTrackingConfiguration {
31+
override predicate isSink(Element e) {
32+
exists(Operation op |
33+
missingGuard(op, e, _) and
34+
op.getAnOperand() = e
35+
|
36+
op instanceof UnaryArithmeticOperation or
37+
op instanceof BinaryArithmeticOperation
38+
)
39+
}
40+
}
41+
42+
from Expr origin, Expr e, string effect, PathNode sourceNode, PathNode sinkNode, Operation op
2143
where
22-
isUserInput(origin, _) and
23-
tainted(origin, e) and
44+
taintedWithPath(origin, e, sourceNode, sinkNode) and
2445
op.getAnOperand() = e and
25-
(
26-
missingGuardAgainstUnderflow(op, e) and effect = "underflow"
27-
or
28-
missingGuardAgainstOverflow(op, e) and effect = "overflow"
29-
or
30-
not e instanceof VariableAccess and effect = "overflow"
31-
) and
32-
(
33-
op instanceof UnaryArithmeticOperation or
34-
op instanceof BinaryArithmeticOperation
35-
)
36-
select e, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
37-
origin, "User-provided value"
46+
missingGuard(op, e, effect)
47+
select e, sourceNode, sinkNode,
48+
"$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".", origin,
49+
"User-provided value"

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected

Lines changed: 68 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,68 @@
1-
| test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
2-
| test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
3-
| test5.cpp:17:6:17:18 | call to getTaintedInt | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
4-
| test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
5-
| test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
6-
| test.c:14:15:14:28 | maxConnections | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:11:29:11:32 | argv | User-provided value |
7-
| test.c:14:15:14:28 | maxConnections | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:11:29:11:32 | argv | User-provided value |
8-
| test.c:44:7:44:10 | len2 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:41:17:41:20 | argv | User-provided value |
9-
| test.c:54:7:54:10 | len3 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:51:17:51:20 | argv | User-provided value |
1+
edges
2+
| test2.cpp:12:21:12:21 | v | test2.cpp:14:11:14:11 | v |
3+
| test2.cpp:12:21:12:21 | v | test2.cpp:14:11:14:11 | v |
4+
| test2.cpp:25:22:25:23 | & ... | test2.cpp:27:2:27:11 | v |
5+
| test2.cpp:25:22:25:23 | fscanf output argument | test2.cpp:27:2:27:11 | v |
6+
| test2.cpp:27:2:27:11 | v | test2.cpp:12:21:12:21 | v |
7+
| test5.cpp:9:7:9:9 | buf | test5.cpp:10:9:10:27 | Store |
8+
| test5.cpp:9:7:9:9 | gets output argument | test5.cpp:10:9:10:27 | Store |
9+
| test5.cpp:10:9:10:27 | Store | test5.cpp:17:6:17:18 | call to getTaintedInt |
10+
| test5.cpp:10:9:10:27 | Store | test5.cpp:17:6:17:18 | call to getTaintedInt |
11+
| test5.cpp:10:9:10:27 | Store | test5.cpp:18:6:18:18 | call to getTaintedInt |
12+
| test5.cpp:18:6:18:18 | call to getTaintedInt | test5.cpp:19:6:19:6 | y |
13+
| test5.cpp:18:6:18:18 | call to getTaintedInt | test5.cpp:19:6:19:6 | y |
14+
| test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections |
15+
| test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections |
16+
| test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections |
17+
| test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections |
18+
| test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 |
19+
| test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 |
20+
| test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 |
21+
| test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 |
22+
| test.c:51:17:51:20 | argv | test.c:54:7:54:10 | len3 |
23+
| test.c:51:17:51:20 | argv | test.c:54:7:54:10 | len3 |
24+
| test.c:51:17:51:20 | argv | test.c:54:7:54:10 | len3 |
25+
| test.c:51:17:51:20 | argv | test.c:54:7:54:10 | len3 |
26+
nodes
27+
| test2.cpp:12:21:12:21 | v | semmle.label | v |
28+
| test2.cpp:14:11:14:11 | v | semmle.label | v |
29+
| test2.cpp:14:11:14:11 | v | semmle.label | v |
30+
| test2.cpp:14:11:14:11 | v | semmle.label | v |
31+
| test2.cpp:25:22:25:23 | & ... | semmle.label | & ... |
32+
| test2.cpp:25:22:25:23 | fscanf output argument | semmle.label | fscanf output argument |
33+
| test2.cpp:27:2:27:11 | v | semmle.label | v |
34+
| test5.cpp:9:7:9:9 | buf | semmle.label | buf |
35+
| test5.cpp:9:7:9:9 | gets output argument | semmle.label | gets output argument |
36+
| test5.cpp:10:9:10:27 | Store | semmle.label | Store |
37+
| test5.cpp:17:6:17:18 | call to getTaintedInt | semmle.label | call to getTaintedInt |
38+
| test5.cpp:17:6:17:18 | call to getTaintedInt | semmle.label | call to getTaintedInt |
39+
| test5.cpp:17:6:17:18 | call to getTaintedInt | semmle.label | call to getTaintedInt |
40+
| test5.cpp:18:6:18:18 | call to getTaintedInt | semmle.label | call to getTaintedInt |
41+
| test5.cpp:19:6:19:6 | y | semmle.label | y |
42+
| test5.cpp:19:6:19:6 | y | semmle.label | y |
43+
| test5.cpp:19:6:19:6 | y | semmle.label | y |
44+
| test.c:11:29:11:32 | argv | semmle.label | argv |
45+
| test.c:11:29:11:32 | argv | semmle.label | argv |
46+
| test.c:14:15:14:28 | maxConnections | semmle.label | maxConnections |
47+
| test.c:14:15:14:28 | maxConnections | semmle.label | maxConnections |
48+
| test.c:14:15:14:28 | maxConnections | semmle.label | maxConnections |
49+
| test.c:41:17:41:20 | argv | semmle.label | argv |
50+
| test.c:41:17:41:20 | argv | semmle.label | argv |
51+
| test.c:44:7:44:10 | len2 | semmle.label | len2 |
52+
| test.c:44:7:44:10 | len2 | semmle.label | len2 |
53+
| test.c:44:7:44:10 | len2 | semmle.label | len2 |
54+
| test.c:51:17:51:20 | argv | semmle.label | argv |
55+
| test.c:51:17:51:20 | argv | semmle.label | argv |
56+
| test.c:54:7:54:10 | len3 | semmle.label | len3 |
57+
| test.c:54:7:54:10 | len3 | semmle.label | len3 |
58+
| test.c:54:7:54:10 | len3 | semmle.label | len3 |
59+
#select
60+
| test2.cpp:14:11:14:11 | v | test2.cpp:25:22:25:23 | & ... | test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
61+
| test2.cpp:14:11:14:11 | v | test2.cpp:25:22:25:23 | & ... | test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
62+
| test5.cpp:17:6:17:18 | call to getTaintedInt | test5.cpp:9:7:9:9 | buf | test5.cpp:17:6:17:18 | call to getTaintedInt | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
63+
| test5.cpp:19:6:19:6 | y | test5.cpp:9:7:9:9 | buf | test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
64+
| test5.cpp:19:6:19:6 | y | test5.cpp:9:7:9:9 | buf | test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
65+
| test.c:14:15:14:28 | maxConnections | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:11:29:11:32 | argv | User-provided value |
66+
| test.c:14:15:14:28 | maxConnections | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:11:29:11:32 | argv | User-provided value |
67+
| test.c:44:7:44:10 | len2 | test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:41:17:41:20 | argv | User-provided value |
68+
| test.c:54:7:54:10 | len3 | test.c:51:17:51:20 | argv | test.c:54:7:54:10 | len3 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:51:17:51:20 | argv | User-provided value |

0 commit comments

Comments
 (0)