Skip to content

Commit 05ecd2e

Browse files
jketemajketema
authored
Merge pull request github#11958 from jketema/argv-if-tests
C++: Add some additional uncontrolled format string tests
2 parents 45aaeb8 + cfc0dab commit 05ecd2e

File tree

2 files changed

+74
-0
lines changed

2 files changed

+74
-0
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.c

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,4 +168,34 @@ int main(int argc, char **argv) {
168168
int i10 = (int) argv[1];
169169
printf((char *) i10);
170170
printWrapper((char *) i10);
171+
172+
// BAD: b value comes from argv
173+
{
174+
char b[64];
175+
char *bp = &b[0];
176+
char *t;
177+
if (0) {
178+
t = 0;
179+
} else {
180+
t = bp;
181+
}
182+
memcpy(t, argv[1] + 1, 1);
183+
printf(bp);
184+
printWrapper(bp);
185+
}
186+
187+
// BAD: b value comes from argv
188+
{
189+
char b[64];
190+
char *bp = &b[0];
191+
char *t;
192+
if (1) {
193+
t = ++bp;
194+
} else {
195+
t = 0;
196+
}
197+
memcpy(t, argv[1] + 1, 1);
198+
printf(bp);
199+
printWrapper(bp);
200+
}
171201
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,30 @@ edges
260260
| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
261261
| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
262262
| argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 |
263+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | (const char *)... |
264+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | (const char *)... |
265+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp |
266+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp |
267+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp indirection |
268+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp indirection |
269+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp |
270+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp |
271+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp |
272+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp |
273+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp indirection |
274+
| argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp indirection |
275+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | (const char *)... |
276+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | (const char *)... |
277+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp |
278+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp |
279+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp indirection |
280+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp indirection |
281+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp |
282+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp |
283+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp |
284+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp |
285+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp indirection |
286+
| argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp indirection |
263287
subpaths
264288
| argvLocal.c:102:15:102:16 | i1 indirection | argvLocal.c:9:25:9:31 | *correct | argvLocal.c:9:25:9:31 | ReturnIndirection | argvLocal.c:102:15:102:16 | printWrapper output argument |
265289
| argvLocal.c:107:15:107:19 | access to array indirection | argvLocal.c:9:25:9:31 | *correct | argvLocal.c:9:25:9:31 | ReturnIndirection | argvLocal.c:107:15:107:19 | printWrapper output argument |
@@ -396,6 +420,22 @@ nodes
396420
| argvLocal.c:170:15:170:26 | i10 indirection | semmle.label | i10 indirection |
397421
| argvLocal.c:170:24:170:26 | i10 | semmle.label | i10 |
398422
| argvLocal.c:170:24:170:26 | i10 | semmle.label | i10 |
423+
| argvLocal.c:182:13:182:16 | argv | semmle.label | argv |
424+
| argvLocal.c:182:13:182:16 | argv | semmle.label | argv |
425+
| argvLocal.c:183:10:183:11 | (const char *)... | semmle.label | (const char *)... |
426+
| argvLocal.c:183:10:183:11 | bp | semmle.label | bp |
427+
| argvLocal.c:183:10:183:11 | bp indirection | semmle.label | bp indirection |
428+
| argvLocal.c:184:16:184:17 | bp | semmle.label | bp |
429+
| argvLocal.c:184:16:184:17 | bp | semmle.label | bp |
430+
| argvLocal.c:184:16:184:17 | bp indirection | semmle.label | bp indirection |
431+
| argvLocal.c:197:13:197:16 | argv | semmle.label | argv |
432+
| argvLocal.c:197:13:197:16 | argv | semmle.label | argv |
433+
| argvLocal.c:198:10:198:11 | (const char *)... | semmle.label | (const char *)... |
434+
| argvLocal.c:198:10:198:11 | bp | semmle.label | bp |
435+
| argvLocal.c:198:10:198:11 | bp indirection | semmle.label | bp indirection |
436+
| argvLocal.c:199:16:199:17 | bp | semmle.label | bp |
437+
| argvLocal.c:199:16:199:17 | bp | semmle.label | bp |
438+
| argvLocal.c:199:16:199:17 | bp indirection | semmle.label | bp indirection |
399439
#select
400440
| argvLocal.c:95:9:95:15 | access to array | argvLocal.c:95:9:95:12 | argv | argvLocal.c:95:9:95:15 | access to array | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | argvLocal.c:95:9:95:12 | argv | argv |
401441
| argvLocal.c:96:15:96:21 | access to array | argvLocal.c:96:15:96:18 | argv | argvLocal.c:96:15:96:21 | access to array | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:96:15:96:18 | argv | argv |
@@ -425,3 +465,7 @@ nodes
425465
| argvLocal.c:165:15:165:17 | i91 | argvLocal.c:163:22:163:25 | argv | argvLocal.c:165:15:165:17 | i91 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:163:22:163:25 | argv | argv |
426466
| argvLocal.c:169:18:169:20 | i10 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:169:18:169:20 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | argvLocal.c:168:18:168:21 | argv | argv |
427467
| argvLocal.c:170:24:170:26 | i10 | argvLocal.c:168:18:168:21 | argv | argvLocal.c:170:24:170:26 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:168:18:168:21 | argv | argv |
468+
| argvLocal.c:183:10:183:11 | bp | argvLocal.c:182:13:182:16 | argv | argvLocal.c:183:10:183:11 | bp | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | argvLocal.c:182:13:182:16 | argv | argv |
469+
| argvLocal.c:184:16:184:17 | bp | argvLocal.c:182:13:182:16 | argv | argvLocal.c:184:16:184:17 | bp | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:182:13:182:16 | argv | argv |
470+
| argvLocal.c:198:10:198:11 | bp | argvLocal.c:197:13:197:16 | argv | argvLocal.c:198:10:198:11 | bp | The value of this argument may come from $@ and is being used as a formatting argument to printf(format). | argvLocal.c:197:13:197:16 | argv | argv |
471+
| argvLocal.c:199:16:199:17 | bp | argvLocal.c:197:13:197:16 | argv | argvLocal.c:199:16:199:17 | bp | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format). | argvLocal.c:197:13:197:16 | argv | argv |

0 commit comments

Comments
 (0)