Skip to content

Commit d86a0ab

Browse files
geoffw0geoffw0
committed
C++: Add test cases involving file descriptor versions.
1 parent 0659195 commit d86a0ab

File tree

2 files changed

+89
-13
lines changed

2 files changed

+89
-13
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/TOCTOUFilesystemRace.expected

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
1-
| test2.cpp:31:7:31:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:31:13:31:16 | path | filename | test2.cpp:26:6:26:10 | call to fopen | checked |
2-
| test2.cpp:44:7:44:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:44:13:44:16 | path | filename | test2.cpp:44:7:44:11 | call to fopen | checked |
3-
| test2.cpp:61:7:61:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:61:13:61:16 | path | filename | test2.cpp:59:6:59:9 | call to stat | checked |
4-
| test2.cpp:90:7:90:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:90:13:90:16 | path | filename | test2.cpp:88:15:88:17 | foo | checked |
5-
| test2.cpp:155:3:155:7 | call to chmod | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:155:9:155:12 | path | filename | test2.cpp:148:6:148:10 | call to fopen | checked |
6-
| test2.cpp:195:3:195:8 | call to remove | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:195:10:195:14 | path1 | filename | test2.cpp:193:7:193:12 | call to rename | checked |
7-
| test2.cpp:205:3:205:8 | call to remove | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:205:10:205:14 | path1 | filename | test2.cpp:201:6:201:11 | call to rename | checked |
8-
| test2.cpp:237:7:237:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:237:13:237:16 | path | filename | test2.cpp:235:6:235:11 | call to access | checked |
1+
| test2.cpp:39:7:39:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:39:13:39:16 | path | filename | test2.cpp:34:6:34:10 | call to fopen | checked |
2+
| test2.cpp:52:7:52:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:52:13:52:16 | path | filename | test2.cpp:52:7:52:11 | call to fopen | checked |
3+
| test2.cpp:69:7:69:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:69:13:69:16 | path | filename | test2.cpp:67:6:67:9 | call to stat | checked |
4+
| test2.cpp:98:7:98:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:98:13:98:16 | path | filename | test2.cpp:96:15:96:17 | foo | checked |
5+
| test2.cpp:157:7:157:10 | call to open | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:157:12:157:15 | path | filename | test2.cpp:155:6:155:9 | call to stat | checked |
6+
| test2.cpp:170:7:170:10 | call to open | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:170:12:170:15 | path | filename | test2.cpp:168:6:168:10 | call to lstat | checked |
7+
| test2.cpp:229:3:229:7 | call to chmod | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:229:9:229:12 | path | filename | test2.cpp:222:6:222:10 | call to fopen | checked |
8+
| test2.cpp:269:3:269:8 | call to remove | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:269:10:269:14 | path1 | filename | test2.cpp:267:7:267:12 | call to rename | checked |
9+
| test2.cpp:279:3:279:8 | call to remove | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:279:10:279:14 | path1 | filename | test2.cpp:275:6:275:11 | call to rename | checked |
10+
| test2.cpp:311:7:311:11 | call to fopen | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test2.cpp:311:13:311:16 | path | filename | test2.cpp:309:6:309:11 | call to access | checked |
911
| test.cpp:21:3:21:8 | call to remove | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test.cpp:21:10:21:14 | file1 | filename | test.cpp:19:7:19:12 | call to rename | checked |
1012
| test.cpp:35:3:35:8 | call to remove | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test.cpp:35:10:35:14 | file1 | filename | test.cpp:32:7:32:12 | call to rename | checked |
1113
| test.cpp:49:3:49:8 | call to remove | The $@ being operated upon was previously $@, but the underlying file may have been changed since then. | test.cpp:49:10:49:14 | file1 | filename | test.cpp:47:7:47:12 | call to rename | checked |

‎cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp

Lines changed: 79 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,22 @@ typedef struct {
1010
FILE *fopen(const char *filename, const char *mode);
1111
int fclose(FILE *stream);
1212

13+
int open(const char *filename, int arg);
14+
int creat(const char *filename, int arg);
15+
int openat(int dir, const char *filename, int arg);
16+
int close(int file);
17+
1318
bool stat(const char *path, stat_data *buf);
19+
bool fstat(int file, stat_data *buf);
20+
bool lstat(const char *path, stat_data *buf);
21+
bool fstatat(int dir, const char *path, stat_data *buf);
1422
void chmod(const char *path, int setting);
1523
bool rename(const char *from, const char *to);
1624
bool remove(const char *path);
1725

1826
bool access(const char *path);
1927

20-
// ---
28+
// --- open -> open ---
2129

2230
void test1_1(const char *path)
2331
{
@@ -49,7 +57,7 @@ void test1_2(const char *path)
4957
// ...
5058
}
5159

52-
// ---
60+
// --- stat -> open ---
5361

5462
void test2_1(const char *path)
5563
{
@@ -139,7 +147,73 @@ void test2_6(const char *path)
139147
// ...
140148
}
141149

142-
// ---
150+
void test2_7(const char *path, int arg)
151+
{
152+
stat_data buf;
153+
int f;
154+
155+
if (stat(path, &buf))
156+
{
157+
f = open(path, arg); // BAD
158+
}
159+
160+
// ...
161+
}
162+
163+
void test2_8(const char *path, int arg)
164+
{
165+
stat_data buf;
166+
int f;
167+
168+
if (lstat(path, &buf))
169+
{
170+
f = open(path, arg); // BAD
171+
}
172+
173+
// ...
174+
}
175+
176+
void test2_9(const char *path, int arg)
177+
{
178+
stat_data buf;
179+
int f;
180+
181+
if (stat(path, &buf))
182+
{
183+
f = creat(path, arg); // BAD [NOT DETECTED]
184+
}
185+
186+
// ...
187+
}
188+
189+
void test2_10(int dir, const char *path, int arg)
190+
{
191+
stat_data buf;
192+
int f;
193+
194+
if (fstatat(dir, path, &buf))
195+
{
196+
f = openat(dir, path, arg); // BAD [NOT DETECTED]
197+
}
198+
199+
// ...
200+
}
201+
202+
void test2_11(const char *path, int arg)
203+
{
204+
stat_data buf;
205+
int f;
206+
207+
f = open(path, arg);
208+
if (fstat(f, &buf)) // GOOD (uses file descriptor, not path)
209+
{
210+
// ...
211+
}
212+
213+
// ...
214+
}
215+
216+
// --- open -> chmod ---
143217

144218
void test3_1(const char *path)
145219
{
@@ -186,7 +260,7 @@ void test3_3(const char *path1, const char *path2)
186260
}
187261
}
188262

189-
// ---
263+
// --- rename -> remove / open ---
190264

191265
void test4_1(const char *path1, const char *path2)
192266
{
@@ -226,7 +300,7 @@ void test4_4(const char *path1, const char *path2)
226300
}
227301
}
228302

229-
// ---
303+
// --- access -> open ---
230304

231305
void test5_1(const char *path)
232306
{

0 commit comments

Comments
 (0)