Skip to content

Commit 436b18a

Browse files
geoffw0geoffw0
committed
C++: Add test cases.
1 parent 6bbed9d commit 436b18a

File tree

3 files changed

+109
-23
lines changed

3 files changed

+109
-23
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/ArithmeticUncontrolled.expected

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,23 @@ edges
2121
| test.cpp:30:13:30:14 | get_rand2 output argument [[]] | test.cpp:30:13:30:14 | Chi |
2222
| test.cpp:36:13:36:13 | Chi | test.cpp:37:7:37:7 | r |
2323
| test.cpp:36:13:36:13 | get_rand3 output argument [[]] | test.cpp:36:13:36:13 | Chi |
24+
| test.cpp:62:19:62:22 | call to rand | test.cpp:65:9:65:9 | x |
25+
| test.cpp:62:19:62:24 | (unsigned int)... | test.cpp:65:9:65:9 | x |
2426
| test.cpp:86:10:86:13 | call to rand | test.cpp:90:10:90:10 | x |
2527
| test.cpp:98:10:98:13 | call to rand | test.cpp:102:10:102:10 | x |
28+
| test.cpp:137:10:137:13 | call to rand | test.cpp:146:9:146:9 | y |
2629
| test.cpp:151:10:151:13 | call to rand | test.cpp:154:10:154:10 | b |
2730
| test.cpp:169:11:169:14 | call to rand | test.cpp:171:11:171:16 | (int)... |
2831
| test.cpp:169:11:169:14 | call to rand | test.cpp:171:16:171:16 | y |
32+
| test.cpp:189:10:189:13 | call to rand | test.cpp:196:7:196:7 | x |
33+
| test.cpp:189:10:189:13 | call to rand | test.cpp:198:7:198:7 | x |
34+
| test.cpp:189:10:189:13 | call to rand | test.cpp:199:7:199:7 | x |
35+
| test.cpp:190:10:190:13 | call to rand | test.cpp:204:7:204:7 | y |
36+
| test.cpp:190:10:190:13 | call to rand | test.cpp:205:7:205:7 | y |
37+
| test.cpp:190:10:190:13 | call to rand | test.cpp:208:7:208:7 | y |
38+
| test.cpp:215:11:215:14 | call to rand | test.cpp:219:8:219:8 | x |
39+
| test.cpp:223:20:223:23 | call to rand | test.cpp:227:8:227:8 | x |
40+
| test.cpp:223:20:223:25 | (unsigned int)... | test.cpp:227:8:227:8 | x |
2941
nodes
3042
| test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
3143
| test.c:21:17:21:17 | r | semmle.label | r |
@@ -60,15 +72,33 @@ nodes
6072
| test.cpp:36:13:36:13 | Chi | semmle.label | Chi |
6173
| test.cpp:36:13:36:13 | get_rand3 output argument [[]] | semmle.label | get_rand3 output argument [[]] |
6274
| test.cpp:37:7:37:7 | r | semmle.label | r |
75+
| test.cpp:62:19:62:22 | call to rand | semmle.label | call to rand |
76+
| test.cpp:62:19:62:24 | (unsigned int)... | semmle.label | (unsigned int)... |
77+
| test.cpp:65:9:65:9 | x | semmle.label | x |
6378
| test.cpp:86:10:86:13 | call to rand | semmle.label | call to rand |
6479
| test.cpp:90:10:90:10 | x | semmle.label | x |
6580
| test.cpp:98:10:98:13 | call to rand | semmle.label | call to rand |
6681
| test.cpp:102:10:102:10 | x | semmle.label | x |
82+
| test.cpp:137:10:137:13 | call to rand | semmle.label | call to rand |
83+
| test.cpp:146:9:146:9 | y | semmle.label | y |
6784
| test.cpp:151:10:151:13 | call to rand | semmle.label | call to rand |
6885
| test.cpp:154:10:154:10 | b | semmle.label | b |
6986
| test.cpp:169:11:169:14 | call to rand | semmle.label | call to rand |
7087
| test.cpp:171:11:171:16 | (int)... | semmle.label | (int)... |
7188
| test.cpp:171:16:171:16 | y | semmle.label | y |
89+
| test.cpp:189:10:189:13 | call to rand | semmle.label | call to rand |
90+
| test.cpp:190:10:190:13 | call to rand | semmle.label | call to rand |
91+
| test.cpp:196:7:196:7 | x | semmle.label | x |
92+
| test.cpp:198:7:198:7 | x | semmle.label | x |
93+
| test.cpp:199:7:199:7 | x | semmle.label | x |
94+
| test.cpp:204:7:204:7 | y | semmle.label | y |
95+
| test.cpp:205:7:205:7 | y | semmle.label | y |
96+
| test.cpp:208:7:208:7 | y | semmle.label | y |
97+
| test.cpp:215:11:215:14 | call to rand | semmle.label | call to rand |
98+
| test.cpp:219:8:219:8 | x | semmle.label | x |
99+
| test.cpp:223:20:223:23 | call to rand | semmle.label | call to rand |
100+
| test.cpp:223:20:223:25 | (unsigned int)... | semmle.label | (unsigned int)... |
101+
| test.cpp:227:8:227:8 | x | semmle.label | x |
72102
#select
73103
| test.c:21:17:21:17 | r | test.c:18:13:18:16 | call to rand | test.c:21:17:21:17 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:18:13:18:16 | call to rand | Uncontrolled value |
74104
| test.c:35:5:35:5 | r | test.c:34:13:34:18 | call to rand | test.c:35:5:35:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:34:13:34:18 | call to rand | Uncontrolled value |
@@ -84,8 +114,20 @@ nodes
84114
| test.cpp:25:7:25:7 | r | test.cpp:8:9:8:12 | call to rand | test.cpp:25:7:25:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:8:9:8:12 | call to rand | Uncontrolled value |
85115
| test.cpp:31:7:31:7 | r | test.cpp:13:10:13:13 | call to rand | test.cpp:31:7:31:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:13:10:13:13 | call to rand | Uncontrolled value |
86116
| test.cpp:37:7:37:7 | r | test.cpp:18:9:18:12 | call to rand | test.cpp:37:7:37:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:18:9:18:12 | call to rand | Uncontrolled value |
117+
| test.cpp:65:9:65:9 | x | test.cpp:62:19:62:22 | call to rand | test.cpp:65:9:65:9 | x | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:62:19:62:22 | call to rand | Uncontrolled value |
118+
| test.cpp:65:9:65:9 | x | test.cpp:62:19:62:24 | (unsigned int)... | test.cpp:65:9:65:9 | x | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:62:19:62:22 | call to rand | Uncontrolled value |
87119
| test.cpp:90:10:90:10 | x | test.cpp:86:10:86:13 | call to rand | test.cpp:90:10:90:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:86:10:86:13 | call to rand | Uncontrolled value |
88120
| test.cpp:102:10:102:10 | x | test.cpp:98:10:98:13 | call to rand | test.cpp:102:10:102:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:98:10:98:13 | call to rand | Uncontrolled value |
121+
| test.cpp:146:9:146:9 | y | test.cpp:137:10:137:13 | call to rand | test.cpp:146:9:146:9 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:137:10:137:13 | call to rand | Uncontrolled value |
89122
| test.cpp:154:10:154:10 | b | test.cpp:151:10:151:13 | call to rand | test.cpp:154:10:154:10 | b | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:151:10:151:13 | call to rand | Uncontrolled value |
90123
| test.cpp:171:11:171:16 | (int)... | test.cpp:169:11:169:14 | call to rand | test.cpp:171:11:171:16 | (int)... | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:169:11:169:14 | call to rand | Uncontrolled value |
91124
| test.cpp:171:16:171:16 | y | test.cpp:169:11:169:14 | call to rand | test.cpp:171:16:171:16 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:169:11:169:14 | call to rand | Uncontrolled value |
125+
| test.cpp:196:7:196:7 | x | test.cpp:189:10:189:13 | call to rand | test.cpp:196:7:196:7 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:189:10:189:13 | call to rand | Uncontrolled value |
126+
| test.cpp:198:7:198:7 | x | test.cpp:189:10:189:13 | call to rand | test.cpp:198:7:198:7 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:189:10:189:13 | call to rand | Uncontrolled value |
127+
| test.cpp:199:7:199:7 | x | test.cpp:189:10:189:13 | call to rand | test.cpp:199:7:199:7 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:189:10:189:13 | call to rand | Uncontrolled value |
128+
| test.cpp:204:7:204:7 | y | test.cpp:190:10:190:13 | call to rand | test.cpp:204:7:204:7 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:190:10:190:13 | call to rand | Uncontrolled value |
129+
| test.cpp:205:7:205:7 | y | test.cpp:190:10:190:13 | call to rand | test.cpp:205:7:205:7 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:190:10:190:13 | call to rand | Uncontrolled value |
130+
| test.cpp:208:7:208:7 | y | test.cpp:190:10:190:13 | call to rand | test.cpp:208:7:208:7 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:190:10:190:13 | call to rand | Uncontrolled value |
131+
| test.cpp:219:8:219:8 | x | test.cpp:215:11:215:14 | call to rand | test.cpp:219:8:219:8 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:215:11:215:14 | call to rand | Uncontrolled value |
132+
| test.cpp:227:8:227:8 | x | test.cpp:223:20:223:23 | call to rand | test.cpp:227:8:227:8 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:223:20:223:23 | call to rand | Uncontrolled value |
133+
| test.cpp:227:8:227:8 | x | test.cpp:223:20:223:25 | (unsigned int)... | test.cpp:227:8:227:8 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:223:20:223:23 | call to rand | Uncontrolled value |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -133,11 +133,11 @@ void moreTests() {
133133
r *= 100; // BAD [NOT DETECTED]
134134
}
135135

136-
137-
138-
139-
140-
136+
{
137+
int r = rand();
138+
int v = 100;
139+
v *= r; // BAD [NOT DETECTED]
140+
}
141141

142142
{
143143
int r = rand();

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp

Lines changed: 62 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,13 @@ int test_remainder_subtract()
5757
return x - y; // GOOD (as y <= x)
5858
}
5959

60+
unsigned int test_remainder_subtract_unsigned()
61+
{
62+
unsigned int x = rand();
63+
unsigned int y = x % 100; // y <= x
6064

61-
62-
63-
64-
65-
66-
65+
return x - y; // GOOD (as y <= x) [FALSE POSITIVE]
66+
}
6767

6868
typedef unsigned long size_t;
6969
int snprintf(char *s, size_t n, const char *format, ...);
@@ -132,19 +132,19 @@ int test_conditional_assignment_2()
132132
return y * 10; // GOOD (as y <= 100)
133133
}
134134

135+
int test_conditional_assignment_3()
136+
{
137+
int x = rand();
138+
int y = 100;
139+
int c = 10;
135140

136-
137-
138-
139-
140-
141-
142-
143-
144-
145-
146-
147-
141+
if (x < y)
142+
{
143+
y = x;
144+
}
145+
146+
return y * c; // GOOD (as y <= 100) [FALSE POSITIVE]
147+
}
148148

149149
int test_underflow()
150150
{
@@ -183,3 +183,47 @@ void test_float()
183183
int z = (int)y * 5; // GOOD
184184
}
185185
}
186+
187+
void test_if_const_bounded()
188+
{
189+
int x = rand();
190+
int y = rand();
191+
int c = 10;
192+
193+
if (x < 1000)
194+
{
195+
x = x * 2; // GOOD
196+
x = x * c; // GOOD [FALSE POSITIVE]
197+
} else {
198+
x = x * 2; // BAD
199+
x = x * c; // BAD
200+
}
201+
202+
if (y > 1000)
203+
{
204+
y = y * 2; // BAD
205+
y = y * c; // BAD
206+
} else {
207+
y = y * 2; // GOOD
208+
y = y * c; // GOOD [FALSE POSITIVE]
209+
}
210+
}
211+
212+
void test_mod_limit()
213+
{
214+
{
215+
int x = rand();
216+
int y = 100;
217+
int z;
218+
219+
z = (x + y) % 1000; // BAD
220+
}
221+
222+
{
223+
unsigned int x = rand();
224+
unsigned int y = 100;
225+
unsigned int z;
226+
227+
z = (x + y) % 1000; // DUBIOUS (this could overflow but the result is controlled) [REPORTED]
228+
}
229+
}

0 commit comments

Comments
 (0)