Skip to content

Commit 07004bd

Browse files
geoffw0geoffw0
committed
C++: Test cases motivated by a real world FP.
1 parent 3681ace commit 07004bd

File tree

3 files changed

+32
-12
lines changed

3 files changed

+32
-12
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,8 @@
105105
| tests.cpp:994:2:994:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
106106
| tests.cpp:1001:2:1001:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
107107
| tests.cpp:1009:2:1009:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
108+
| tests.cpp:1028:2:1028:7 | call to memset | This 'memset' operation accesses 120 bytes but the $@ is only 40 bytes. | tests.cpp:1020:12:1020:15 | arr1 | destination buffer |
109+
| tests.cpp:1031:2:1031:7 | call to memset | This 'memset' operation accesses 130 bytes but the $@ is only 40 bytes. | tests.cpp:1020:12:1020:15 | arr1 | destination buffer |
108110
| tests_restrict.c:12:2:12:7 | call to memcpy | This 'memcpy' operation accesses 2 bytes but the $@ is only 1 byte. | tests_restrict.c:7:6:7:13 | smallbuf | source buffer |
109111
| unions.cpp:26:2:26:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:21:10:21:11 | mu | destination buffer |
110112
| unions.cpp:30:2:30:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ edges
2727
| main.cpp:9:29:9:32 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
2828
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | **argv | provenance | |
2929
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | *argv | provenance | |
30-
| main.cpp:10:20:10:23 | **argv | tests.cpp:1017:32:1017:35 | **argv | provenance | |
31-
| main.cpp:10:20:10:23 | *argv | tests.cpp:1017:32:1017:35 | *argv | provenance | |
30+
| main.cpp:10:20:10:23 | **argv | tests.cpp:1034:32:1034:35 | **argv | provenance | |
31+
| main.cpp:10:20:10:23 | *argv | tests.cpp:1034:32:1034:35 | *argv | provenance | |
3232
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | **argv | provenance | |
3333
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | *argv | provenance | |
3434
| test_buffer_overrun.cpp:32:46:32:49 | **argv | test_buffer_overrun.cpp:32:46:32:49 | **argv | provenance | |
@@ -41,12 +41,12 @@ edges
4141
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:14:649:19 | *home | provenance | |
4242
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:16:649:19 | *home | provenance | |
4343
| tests.cpp:649:16:649:19 | *home | tests.cpp:649:14:649:19 | *home | provenance | |
44-
| tests.cpp:1017:32:1017:35 | **argv | tests.cpp:1042:9:1042:15 | *access to array | provenance | |
45-
| tests.cpp:1017:32:1017:35 | **argv | tests.cpp:1043:9:1043:15 | *access to array | provenance | |
46-
| tests.cpp:1017:32:1017:35 | *argv | tests.cpp:1042:9:1042:15 | *access to array | provenance | |
47-
| tests.cpp:1017:32:1017:35 | *argv | tests.cpp:1043:9:1043:15 | *access to array | provenance | |
48-
| tests.cpp:1042:9:1042:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
49-
| tests.cpp:1043:9:1043:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
44+
| tests.cpp:1034:32:1034:35 | **argv | tests.cpp:1059:9:1059:15 | *access to array | provenance | |
45+
| tests.cpp:1034:32:1034:35 | **argv | tests.cpp:1060:9:1060:15 | *access to array | provenance | |
46+
| tests.cpp:1034:32:1034:35 | *argv | tests.cpp:1059:9:1059:15 | *access to array | provenance | |
47+
| tests.cpp:1034:32:1034:35 | *argv | tests.cpp:1060:9:1060:15 | *access to array | provenance | |
48+
| tests.cpp:1059:9:1059:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
49+
| tests.cpp:1060:9:1060:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
5050
| tests_restrict.c:15:41:15:44 | **argv | tests_restrict.c:15:41:15:44 | **argv | provenance | |
5151
| tests_restrict.c:15:41:15:44 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
5252
nodes
@@ -80,10 +80,10 @@ nodes
8080
| tests.cpp:649:14:649:14 | *s [*home] | semmle.label | *s [*home] |
8181
| tests.cpp:649:14:649:19 | *home | semmle.label | *home |
8282
| tests.cpp:649:16:649:19 | *home | semmle.label | *home |
83-
| tests.cpp:1017:32:1017:35 | **argv | semmle.label | **argv |
84-
| tests.cpp:1017:32:1017:35 | *argv | semmle.label | *argv |
85-
| tests.cpp:1042:9:1042:15 | *access to array | semmle.label | *access to array |
86-
| tests.cpp:1043:9:1043:15 | *access to array | semmle.label | *access to array |
83+
| tests.cpp:1034:32:1034:35 | **argv | semmle.label | **argv |
84+
| tests.cpp:1034:32:1034:35 | *argv | semmle.label | *argv |
85+
| tests.cpp:1059:9:1059:15 | *access to array | semmle.label | *access to array |
86+
| tests.cpp:1060:9:1060:15 | *access to array | semmle.label | *access to array |
8787
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
8888
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
8989
| tests_restrict.c:15:41:15:44 | *argv | semmle.label | *argv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1014,6 +1014,23 @@ void test28() {
10141014
ptr5[-1] = 0; // GOOD (depending what cond() does)
10151015
}
10161016

1017+
typedef int myInt29;
1018+
typedef myInt29 myArray29[10];
1019+
struct _myStruct29 {
1020+
myArray29 arr1;
1021+
myInt29 arr2[20];
1022+
};
1023+
typedef _myStruct29 myStruct29;
1024+
1025+
void test29() {
1026+
myStruct29 *ptr;
1027+
1028+
memset(ptr->arr1, 0, sizeof(ptr->arr1) + sizeof(ptr->arr2)); // GOOD (overwrites arr1, arr2) [FALSE POSITIVE]
1029+
memset(&(ptr->arr1[0]), 0, sizeof(ptr->arr1) + sizeof(ptr->arr2)); // GOOD (overwrites arr1, arr2)
1030+
1031+
memset(ptr->arr1, 0, sizeof(ptr->arr1) + sizeof(ptr->arr2) + 10); // BAD
1032+
}
1033+
10171034
int tests_main(int argc, char *argv[])
10181035
{
10191036
long long arr17[19];
@@ -1044,6 +1061,7 @@ int tests_main(int argc, char *argv[])
10441061
test26();
10451062
test27(argc);
10461063
test28();
1064+
test29();
10471065

10481066
return 0;
10491067
}

0 commit comments

Comments
 (0)