Skip to content

Commit 1c2c48c

Browse files
rdmarsh2rdmarsh2
committed
C++: more constant-array-overflow tests
1 parent 656b4fc commit 1c2c48c

File tree

2 files changed

+117
-0
lines changed

2 files changed

+117
-0
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,101 @@
11
edges
2+
| test.cpp:34:10:34:12 | buf | test.cpp:34:5:34:24 | access to array |
23
| test.cpp:35:10:35:12 | buf | test.cpp:35:5:35:22 | access to array |
34
| test.cpp:36:10:36:12 | buf | test.cpp:36:5:36:24 | access to array |
5+
| test.cpp:39:14:39:16 | buf | test.cpp:39:9:39:19 | access to array |
46
| test.cpp:43:14:43:16 | buf | test.cpp:43:9:43:19 | access to array |
7+
| test.cpp:48:10:48:12 | buf | test.cpp:48:5:48:24 | access to array |
58
| test.cpp:49:10:49:12 | buf | test.cpp:49:5:49:22 | access to array |
69
| test.cpp:50:10:50:12 | buf | test.cpp:50:5:50:24 | access to array |
10+
| test.cpp:53:14:53:16 | buf | test.cpp:53:9:53:19 | access to array |
711
| test.cpp:57:14:57:16 | buf | test.cpp:57:9:57:19 | access to array |
812
| test.cpp:61:14:61:16 | buf | test.cpp:61:9:61:19 | access to array |
13+
| test.cpp:70:33:70:33 | p | test.cpp:71:5:71:17 | access to array |
914
| test.cpp:70:33:70:33 | p | test.cpp:72:5:72:15 | access to array |
15+
| test.cpp:76:26:76:46 | & ... | test.cpp:66:32:66:32 | p |
16+
| test.cpp:76:32:76:34 | buf | test.cpp:76:26:76:46 | & ... |
1017
| test.cpp:77:26:77:44 | & ... | test.cpp:66:32:66:32 | p |
1118
| test.cpp:77:32:77:34 | buf | test.cpp:77:26:77:44 | & ... |
1219
| test.cpp:79:27:79:34 | buf | test.cpp:70:33:70:33 | p |
1320
| test.cpp:79:32:79:34 | buf | test.cpp:79:27:79:34 | buf |
1421
| test.cpp:85:34:85:36 | buf | test.cpp:87:5:87:31 | access to array |
1522
| test.cpp:85:34:85:36 | buf | test.cpp:88:5:88:27 | access to array |
23+
| test.cpp:96:13:96:15 | arr | test.cpp:96:13:96:18 | access to array |
24+
| test.cpp:111:17:111:19 | arr | test.cpp:111:17:111:22 | access to array |
25+
| test.cpp:111:17:111:19 | arr | test.cpp:115:35:115:40 | access to array |
26+
| test.cpp:111:17:111:19 | arr | test.cpp:119:17:119:22 | access to array |
27+
| test.cpp:115:35:115:37 | arr | test.cpp:111:17:111:22 | access to array |
28+
| test.cpp:115:35:115:37 | arr | test.cpp:115:35:115:40 | access to array |
29+
| test.cpp:115:35:115:37 | arr | test.cpp:119:17:119:22 | access to array |
30+
| test.cpp:119:17:119:19 | arr | test.cpp:111:17:111:22 | access to array |
31+
| test.cpp:119:17:119:19 | arr | test.cpp:115:35:115:40 | access to array |
32+
| test.cpp:119:17:119:19 | arr | test.cpp:119:17:119:22 | access to array |
1633
| test.cpp:128:9:128:11 | arr | test.cpp:128:9:128:14 | access to array |
1734
| test.cpp:134:25:134:27 | arr | test.cpp:136:9:136:16 | ... += ... |
1835
| test.cpp:136:9:136:16 | ... += ... | test.cpp:138:13:138:15 | arr |
1936
| test.cpp:143:18:143:21 | asdf | test.cpp:134:25:134:27 | arr |
2037
| test.cpp:143:18:143:21 | asdf | test.cpp:143:18:143:21 | asdf |
38+
| test.cpp:146:26:146:26 | p indirection | test.cpp:148:6:148:9 | * ... |
39+
| test.cpp:156:12:156:14 | buf | test.cpp:156:12:156:18 | ... + ... |
40+
| test.cpp:156:12:156:18 | ... + ... | test.cpp:158:17:158:18 | & ... indirection |
41+
| test.cpp:158:17:158:18 | & ... indirection | test.cpp:146:26:146:26 | p indirection |
2142
nodes
43+
| test.cpp:34:5:34:24 | access to array | semmle.label | access to array |
44+
| test.cpp:34:10:34:12 | buf | semmle.label | buf |
2245
| test.cpp:35:5:35:22 | access to array | semmle.label | access to array |
2346
| test.cpp:35:10:35:12 | buf | semmle.label | buf |
2447
| test.cpp:36:5:36:24 | access to array | semmle.label | access to array |
2548
| test.cpp:36:10:36:12 | buf | semmle.label | buf |
49+
| test.cpp:39:9:39:19 | access to array | semmle.label | access to array |
50+
| test.cpp:39:14:39:16 | buf | semmle.label | buf |
2651
| test.cpp:43:9:43:19 | access to array | semmle.label | access to array |
2752
| test.cpp:43:14:43:16 | buf | semmle.label | buf |
53+
| test.cpp:48:5:48:24 | access to array | semmle.label | access to array |
54+
| test.cpp:48:10:48:12 | buf | semmle.label | buf |
2855
| test.cpp:49:5:49:22 | access to array | semmle.label | access to array |
2956
| test.cpp:49:10:49:12 | buf | semmle.label | buf |
3057
| test.cpp:50:5:50:24 | access to array | semmle.label | access to array |
3158
| test.cpp:50:10:50:12 | buf | semmle.label | buf |
59+
| test.cpp:53:9:53:19 | access to array | semmle.label | access to array |
60+
| test.cpp:53:14:53:16 | buf | semmle.label | buf |
3261
| test.cpp:57:9:57:19 | access to array | semmle.label | access to array |
3362
| test.cpp:57:14:57:16 | buf | semmle.label | buf |
3463
| test.cpp:61:9:61:19 | access to array | semmle.label | access to array |
3564
| test.cpp:61:14:61:16 | buf | semmle.label | buf |
3665
| test.cpp:66:32:66:32 | p | semmle.label | p |
66+
| test.cpp:66:32:66:32 | p | semmle.label | p |
3767
| test.cpp:70:33:70:33 | p | semmle.label | p |
68+
| test.cpp:71:5:71:17 | access to array | semmle.label | access to array |
3869
| test.cpp:72:5:72:15 | access to array | semmle.label | access to array |
70+
| test.cpp:76:26:76:46 | & ... | semmle.label | & ... |
71+
| test.cpp:76:32:76:34 | buf | semmle.label | buf |
3972
| test.cpp:77:26:77:44 | & ... | semmle.label | & ... |
4073
| test.cpp:77:32:77:34 | buf | semmle.label | buf |
4174
| test.cpp:79:27:79:34 | buf | semmle.label | buf |
4275
| test.cpp:79:32:79:34 | buf | semmle.label | buf |
4376
| test.cpp:85:34:85:36 | buf | semmle.label | buf |
4477
| test.cpp:87:5:87:31 | access to array | semmle.label | access to array |
4578
| test.cpp:88:5:88:27 | access to array | semmle.label | access to array |
79+
| test.cpp:96:13:96:15 | arr | semmle.label | arr |
80+
| test.cpp:96:13:96:18 | access to array | semmle.label | access to array |
81+
| test.cpp:111:17:111:19 | arr | semmle.label | arr |
82+
| test.cpp:111:17:111:22 | access to array | semmle.label | access to array |
83+
| test.cpp:115:35:115:37 | arr | semmle.label | arr |
84+
| test.cpp:115:35:115:40 | access to array | semmle.label | access to array |
85+
| test.cpp:119:17:119:19 | arr | semmle.label | arr |
86+
| test.cpp:119:17:119:22 | access to array | semmle.label | access to array |
4687
| test.cpp:128:9:128:11 | arr | semmle.label | arr |
4788
| test.cpp:128:9:128:14 | access to array | semmle.label | access to array |
4889
| test.cpp:134:25:134:27 | arr | semmle.label | arr |
4990
| test.cpp:136:9:136:16 | ... += ... | semmle.label | ... += ... |
5091
| test.cpp:138:13:138:15 | arr | semmle.label | arr |
5192
| test.cpp:143:18:143:21 | asdf | semmle.label | asdf |
5293
| test.cpp:143:18:143:21 | asdf | semmle.label | asdf |
94+
| test.cpp:146:26:146:26 | p indirection | semmle.label | p indirection |
95+
| test.cpp:148:6:148:9 | * ... | semmle.label | * ... |
96+
| test.cpp:156:12:156:14 | buf | semmle.label | buf |
97+
| test.cpp:156:12:156:18 | ... + ... | semmle.label | ... + ... |
98+
| test.cpp:158:17:158:18 | & ... indirection | semmle.label | & ... indirection |
5399
subpaths
54100
#select
55101
| test.cpp:35:5:35:22 | PointerAdd: access to array | test.cpp:35:10:35:12 | buf | test.cpp:35:5:35:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:35:5:35:26 | Store: ... = ... | write |
@@ -63,3 +109,4 @@ subpaths
63109
| test.cpp:77:27:77:44 | PointerAdd: access to array | test.cpp:77:32:77:34 | buf | test.cpp:66:32:66:32 | p | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
64110
| test.cpp:128:9:128:14 | PointerAdd: access to array | test.cpp:128:9:128:11 | arr | test.cpp:128:9:128:14 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:125:11:125:13 | arr | arr | test.cpp:128:9:128:18 | Store: ... = ... | write |
65111
| test.cpp:136:9:136:16 | PointerAdd: ... += ... | test.cpp:143:18:143:21 | asdf | test.cpp:138:13:138:15 | arr | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:142:10:142:13 | asdf | asdf | test.cpp:138:12:138:15 | Load: * ... | read |
112+
| test.cpp:156:12:156:18 | PointerAdd: ... + ... | test.cpp:156:12:156:14 | buf | test.cpp:148:6:148:9 | * ... | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:154:7:154:9 | buf | buf | test.cpp:147:3:147:13 | Store: ... = ... | write |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,73 @@ void testStrncmp1() {
142142
char asdf[5];
143143
testStrncmp2(asdf);
144144
}
145+
146+
void countdownBuf1(int **p) {
147+
*--(*p) = 1; // GOOD [FALSE POSITIVE]
148+
*--(*p) = 2; // GOOD
149+
*--(*p) = 3; // GOOD
150+
*--(*p) = 4; // GOOD
151+
}
152+
153+
void countdownBuf2() {
154+
int buf[4];
155+
156+
int *x = buf + 4;
157+
158+
countdownBuf1(&x);
159+
}
160+
161+
int access(int *p) {
162+
return p[0];
163+
}
164+
165+
166+
// unrolled loop style seen in crypto code.
167+
int countdownLength1(int *p, int len) {
168+
while(len > 0) {
169+
access(p);
170+
p[1] = 1;
171+
p[2] = 2;
172+
p[3] = 3;
173+
p[4] = 4;
174+
p[5] = 5;
175+
p[6] = 6; // BAD [FALSE NEGATIVE]
176+
p[7] = 7; // BAD [FALSE NEGATIVE]
177+
p += 8;
178+
len -= 8;
179+
}
180+
181+
return p[5];
182+
}
183+
184+
int callCountdownLenght() {
185+
186+
int buf[6];
187+
188+
return countdownLength1(buf, 6);
189+
}
190+
191+
int countdownLength2() {
192+
int buf[6];
193+
int len = 6;
194+
int *p = buf;
195+
196+
if(len % 8) {
197+
return -1;
198+
}
199+
200+
while(len > 0) {
201+
p[0] = 0;
202+
p[1] = 1;
203+
p[2] = 2;
204+
p[3] = 3;
205+
p[4] = 4;
206+
p[5] = 5;
207+
p[6] = 6; // GOOD
208+
p[7] = 7; // GOOD
209+
p += 8;
210+
len -= 8;
211+
}
212+
213+
return p[5];
214+
}

0 commit comments

Comments
 (0)