Skip to content

Commit 503c5c9

Browse files
geoffw0geoffw0
committed
C++: Add more test cases.
1 parent 5d3e8d2 commit 503c5c9

File tree

3 files changed

+140
-1
lines changed

3 files changed

+140
-1
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ edges
77
| test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r |
88
| test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r |
99
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
10+
| test.c:125:13:125:16 | call to rand | test.c:127:9:127:9 | r |
1011
| test.cpp:8:9:8:12 | Store | test.cpp:24:11:24:18 | call to get_rand |
1112
| test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
1213
| test.cpp:13:2:13:15 | Chi [[]] | test.cpp:30:13:30:14 | get_rand2 output argument [[]] |
@@ -18,6 +19,19 @@ edges
1819
| test.cpp:30:13:30:14 | get_rand2 output argument [[]] | test.cpp:30:13:30:14 | Chi |
1920
| test.cpp:36:13:36:13 | Chi | test.cpp:37:7:37:7 | r |
2021
| test.cpp:36:13:36:13 | get_rand3 output argument [[]] | test.cpp:36:13:36:13 | Chi |
22+
| test.cpp:54:10:54:13 | call to rand | test.cpp:57:9:57:9 | x |
23+
| test.cpp:63:23:63:31 | buf_start | test.cpp:67:9:67:11 | len |
24+
| test.cpp:63:40:63:46 | buf_end | test.cpp:67:9:67:11 | len |
25+
| test.cpp:72:50:72:53 | call to rand | test.cpp:73:2:73:12 | ... + ... |
26+
| test.cpp:72:50:72:53 | call to rand | test.cpp:73:2:73:12 | buf |
27+
| test.cpp:73:2:73:12 | ... + ... | test.cpp:63:40:63:46 | buf_end |
28+
| test.cpp:73:2:73:12 | buf | test.cpp:63:23:63:31 | buf_start |
29+
| test.cpp:78:10:78:13 | call to rand | test.cpp:82:10:82:10 | x |
30+
| test.cpp:78:10:78:13 | call to rand | test.cpp:84:10:84:10 | x |
31+
| test.cpp:90:10:90:13 | call to rand | test.cpp:94:10:94:10 | x |
32+
| test.cpp:90:10:90:13 | call to rand | test.cpp:97:9:97:9 | x |
33+
| test.cpp:102:10:102:13 | call to rand | test.cpp:108:10:108:10 | y |
34+
| test.cpp:116:10:116:13 | call to rand | test.cpp:124:9:124:9 | y |
2135
nodes
2236
| test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
2337
| test.c:21:17:21:17 | r | semmle.label | r |
@@ -33,6 +47,8 @@ nodes
3347
| test.c:83:9:83:9 | r | semmle.label | r |
3448
| test.c:99:14:99:19 | call to rand | semmle.label | call to rand |
3549
| test.c:100:5:100:5 | r | semmle.label | r |
50+
| test.c:125:13:125:16 | call to rand | semmle.label | call to rand |
51+
| test.c:127:9:127:9 | r | semmle.label | r |
3652
| test.cpp:8:9:8:12 | Store | semmle.label | Store |
3753
| test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
3854
| test.cpp:13:2:13:15 | Chi [[]] | semmle.label | Chi [[]] |
@@ -47,6 +63,24 @@ nodes
4763
| test.cpp:36:13:36:13 | Chi | semmle.label | Chi |
4864
| test.cpp:36:13:36:13 | get_rand3 output argument [[]] | semmle.label | get_rand3 output argument [[]] |
4965
| test.cpp:37:7:37:7 | r | semmle.label | r |
66+
| test.cpp:54:10:54:13 | call to rand | semmle.label | call to rand |
67+
| test.cpp:57:9:57:9 | x | semmle.label | x |
68+
| test.cpp:63:23:63:31 | buf_start | semmle.label | buf_start |
69+
| test.cpp:63:40:63:46 | buf_end | semmle.label | buf_end |
70+
| test.cpp:67:9:67:11 | len | semmle.label | len |
71+
| test.cpp:72:50:72:53 | call to rand | semmle.label | call to rand |
72+
| test.cpp:73:2:73:12 | ... + ... | semmle.label | ... + ... |
73+
| test.cpp:73:2:73:12 | buf | semmle.label | buf |
74+
| test.cpp:78:10:78:13 | call to rand | semmle.label | call to rand |
75+
| test.cpp:82:10:82:10 | x | semmle.label | x |
76+
| test.cpp:84:10:84:10 | x | semmle.label | x |
77+
| test.cpp:90:10:90:13 | call to rand | semmle.label | call to rand |
78+
| test.cpp:94:10:94:10 | x | semmle.label | x |
79+
| test.cpp:97:9:97:9 | x | semmle.label | x |
80+
| test.cpp:102:10:102:13 | call to rand | semmle.label | call to rand |
81+
| test.cpp:108:10:108:10 | y | semmle.label | y |
82+
| test.cpp:116:10:116:13 | call to rand | semmle.label | call to rand |
83+
| test.cpp:124:9:124:9 | y | semmle.label | y |
5084
#select
5185
| test.c:21:17:21:17 | r | test.c:18:13:18:16 | call to rand | test.c:21:17:21:17 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:18:13:18:16 | call to rand | Uncontrolled value |
5286
| test.c:35:5:35:5 | r | test.c:34:13:34:18 | call to rand | test.c:35:5:35:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:34:13:34:18 | call to rand | Uncontrolled value |
@@ -56,6 +90,17 @@ nodes
5690
| test.c:83:9:83:9 | r | test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:81:14:81:17 | call to rand | Uncontrolled value |
5791
| test.c:83:9:83:9 | r | test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:81:23:81:26 | call to rand | Uncontrolled value |
5892
| test.c:100:5:100:5 | r | test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:99:14:99:19 | call to rand | Uncontrolled value |
93+
| test.c:127:9:127:9 | r | test.c:125:13:125:16 | call to rand | test.c:127:9:127:9 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:125:13:125:16 | call to rand | Uncontrolled value |
94+
| test.c:127:9:127:9 | r | test.c:125:13:125:16 | call to rand | test.c:127:9:127:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:125:13:125:16 | call to rand | Uncontrolled value |
5995
| test.cpp:25:7:25:7 | r | test.cpp:8:9:8:12 | call to rand | test.cpp:25:7:25:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:8:9:8:12 | call to rand | Uncontrolled value |
6096
| test.cpp:31:7:31:7 | r | test.cpp:13:10:13:13 | call to rand | test.cpp:31:7:31:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:13:10:13:13 | call to rand | Uncontrolled value |
6197
| test.cpp:37:7:37:7 | r | test.cpp:18:9:18:12 | call to rand | test.cpp:37:7:37:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:18:9:18:12 | call to rand | Uncontrolled value |
98+
| test.cpp:57:9:57:9 | x | test.cpp:54:10:54:13 | call to rand | test.cpp:57:9:57:9 | x | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:54:10:54:13 | call to rand | Uncontrolled value |
99+
| test.cpp:67:9:67:11 | len | test.cpp:72:50:72:53 | call to rand | test.cpp:67:9:67:11 | len | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:72:50:72:53 | call to rand | Uncontrolled value |
100+
| test.cpp:67:9:67:11 | len | test.cpp:72:50:72:53 | call to rand | test.cpp:67:9:67:11 | len | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:72:50:72:53 | call to rand | Uncontrolled value |
101+
| test.cpp:82:10:82:10 | x | test.cpp:78:10:78:13 | call to rand | test.cpp:82:10:82:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:78:10:78:13 | call to rand | Uncontrolled value |
102+
| test.cpp:84:10:84:10 | x | test.cpp:78:10:78:13 | call to rand | test.cpp:84:10:84:10 | x | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:78:10:78:13 | call to rand | Uncontrolled value |
103+
| test.cpp:94:10:94:10 | x | test.cpp:90:10:90:13 | call to rand | test.cpp:94:10:94:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:90:10:90:13 | call to rand | Uncontrolled value |
104+
| test.cpp:97:9:97:9 | x | test.cpp:90:10:90:13 | call to rand | test.cpp:97:9:97:9 | x | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:90:10:90:13 | call to rand | Uncontrolled value |
105+
| test.cpp:108:10:108:10 | y | test.cpp:102:10:102:13 | call to rand | test.cpp:108:10:108:10 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:102:10:102:13 | call to rand | Uncontrolled value |
106+
| test.cpp:124:9:124:9 | y | test.cpp:116:10:116:13 | call to rand | test.cpp:124:9:124:9 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:116:10:116:13 | call to rand | Uncontrolled value |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/test.c

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,3 +119,22 @@ void randomTester2(int bound, int min, int max) {
119119
int r2 = (rand() % (max - min + 1)) + min;
120120
r2 += 100; // GOOD (This is a common way to clamp the random value between [min, max])
121121
}
122+
123+
void moreTests() {
124+
{
125+
int r = rand();
126+
127+
r = r * 100; // BAD
128+
}
129+
{
130+
int r = rand();
131+
132+
r *= 100; // BAD [NOT DETECTED]
133+
}
134+
135+
{
136+
int r = rand();
137+
138+
r <<= 8; // BAD [NOT DETECTED]
139+
}
140+
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/test.cpp

Lines changed: 76 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,4 +47,79 @@ void test_with_bounded_randomness() {
4747

4848
unsigned unsigned_r = rand(10);
4949
unsigned_r++; // GOOD
50-
}
50+
}
51+
52+
int test_remainder_subtract()
53+
{
54+
int x = rand();
55+
int y = x % 100; // y <= x
56+
57+
return x - y; // GOOD (as y <= x) [FALSE POSITIVE]
58+
}
59+
60+
typedef unsigned long size_t;
61+
int snprintf(char *s, size_t n, const char *format, ...);
62+
63+
int test_buffer(char *buf_start, char *buf_end)
64+
{
65+
int len = buf_end - buf_start;
66+
67+
return len * 2; // GOOD [FALSE POSITIVE]
68+
}
69+
70+
int test_snprintf(char *buf, size_t buf_sz)
71+
{
72+
snprintf(buf, buf_sz, "my random number: %i\n", rand());
73+
test_buffer(buf, buf + buf_sz);
74+
}
75+
76+
int test_else_1()
77+
{
78+
int x = rand();
79+
80+
if (x > 100)
81+
{
82+
return x * 10; // BAD
83+
} else {
84+
return x * 10; // GOOD (as x <= 100) [FALSE POSITIVE]
85+
}
86+
}
87+
88+
int test_else_2()
89+
{
90+
int x = rand();
91+
92+
if (x > 100)
93+
{
94+
return x * 10; // BAD
95+
}
96+
97+
return x * 10; // GOOD (as x <= 100) [FALSE POSITIVE]
98+
}
99+
100+
int test_conditional_assignment_1()
101+
{
102+
int x = rand();
103+
int y = 100;
104+
105+
if (x < y)
106+
{
107+
y = x;
108+
return y * 10; // GOOD (as y <= 100) [FALSE POSITIVE]
109+
} else {
110+
return y * 10; // GOOD (as y = 100)
111+
}
112+
}
113+
114+
int test_conditional_assignment_2()
115+
{
116+
int x = rand();
117+
int y = 100;
118+
119+
if (x < y)
120+
{
121+
y = x;
122+
}
123+
124+
return y * 10; // GOOD (as y <= 100) [FALSE POSITIVE]
125+
}

0 commit comments

Comments
 (0)