Skip to content

Commit 3681ace

Browse files
geoffw0geoffw0
committed
C++: Explore negative indices more in tests.
1 parent 90758b3 commit 3681ace

File tree

3 files changed

+57
-12
lines changed

3 files changed

+57
-12
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.expected

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,11 @@
100100
| tests.cpp:938:2:938:17 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:906:11:906:12 | xs | array |
101101
| tests.cpp:940:2:940:17 | access to array | This array indexing operation accesses byte offset 399 but the $@ is only 40 bytes. | tests.cpp:906:11:906:12 | xs | array |
102102
| tests.cpp:941:2:941:18 | access to array | This array indexing operation accesses byte offset 403 but the $@ is only 40 bytes. | tests.cpp:906:11:906:12 | xs | array |
103+
| tests.cpp:984:2:984:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
104+
| tests.cpp:989:2:989:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
105+
| tests.cpp:994:2:994:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
106+
| tests.cpp:1001:2:1001:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
107+
| tests.cpp:1009:2:1009:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
103108
| tests_restrict.c:12:2:12:7 | call to memcpy | This 'memcpy' operation accesses 2 bytes but the $@ is only 1 byte. | tests_restrict.c:7:6:7:13 | smallbuf | source buffer |
104109
| unions.cpp:26:2:26:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:21:10:21:11 | mu | destination buffer |
105110
| unions.cpp:30:2:30:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ edges
2727
| main.cpp:9:29:9:32 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
2828
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | **argv | provenance | |
2929
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | *argv | provenance | |
30-
| main.cpp:10:20:10:23 | **argv | tests.cpp:978:32:978:35 | **argv | provenance | |
31-
| main.cpp:10:20:10:23 | *argv | tests.cpp:978:32:978:35 | *argv | provenance | |
30+
| main.cpp:10:20:10:23 | **argv | tests.cpp:1017:32:1017:35 | **argv | provenance | |
31+
| main.cpp:10:20:10:23 | *argv | tests.cpp:1017:32:1017:35 | *argv | provenance | |
3232
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | **argv | provenance | |
3333
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | *argv | provenance | |
3434
| test_buffer_overrun.cpp:32:46:32:49 | **argv | test_buffer_overrun.cpp:32:46:32:49 | **argv | provenance | |
@@ -41,12 +41,12 @@ edges
4141
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:14:649:19 | *home | provenance | |
4242
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:16:649:19 | *home | provenance | |
4343
| tests.cpp:649:16:649:19 | *home | tests.cpp:649:14:649:19 | *home | provenance | |
44-
| tests.cpp:978:32:978:35 | **argv | tests.cpp:1003:9:1003:15 | *access to array | provenance | |
45-
| tests.cpp:978:32:978:35 | **argv | tests.cpp:1004:9:1004:15 | *access to array | provenance | |
46-
| tests.cpp:978:32:978:35 | *argv | tests.cpp:1003:9:1003:15 | *access to array | provenance | |
47-
| tests.cpp:978:32:978:35 | *argv | tests.cpp:1004:9:1004:15 | *access to array | provenance | |
48-
| tests.cpp:1003:9:1003:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
49-
| tests.cpp:1004:9:1004:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
44+
| tests.cpp:1017:32:1017:35 | **argv | tests.cpp:1042:9:1042:15 | *access to array | provenance | |
45+
| tests.cpp:1017:32:1017:35 | **argv | tests.cpp:1043:9:1043:15 | *access to array | provenance | |
46+
| tests.cpp:1017:32:1017:35 | *argv | tests.cpp:1042:9:1042:15 | *access to array | provenance | |
47+
| tests.cpp:1017:32:1017:35 | *argv | tests.cpp:1043:9:1043:15 | *access to array | provenance | |
48+
| tests.cpp:1042:9:1042:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
49+
| tests.cpp:1043:9:1043:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
5050
| tests_restrict.c:15:41:15:44 | **argv | tests_restrict.c:15:41:15:44 | **argv | provenance | |
5151
| tests_restrict.c:15:41:15:44 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
5252
nodes
@@ -80,10 +80,10 @@ nodes
8080
| tests.cpp:649:14:649:14 | *s [*home] | semmle.label | *s [*home] |
8181
| tests.cpp:649:14:649:19 | *home | semmle.label | *home |
8282
| tests.cpp:649:16:649:19 | *home | semmle.label | *home |
83-
| tests.cpp:978:32:978:35 | **argv | semmle.label | **argv |
84-
| tests.cpp:978:32:978:35 | *argv | semmle.label | *argv |
85-
| tests.cpp:1003:9:1003:15 | *access to array | semmle.label | *access to array |
86-
| tests.cpp:1004:9:1004:15 | *access to array | semmle.label | *access to array |
83+
| tests.cpp:1017:32:1017:35 | **argv | semmle.label | **argv |
84+
| tests.cpp:1017:32:1017:35 | *argv | semmle.label | *argv |
85+
| tests.cpp:1042:9:1042:15 | *access to array | semmle.label | *access to array |
86+
| tests.cpp:1043:9:1043:15 | *access to array | semmle.label | *access to array |
8787
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
8888
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
8989
| tests_restrict.c:15:41:15:44 | *argv | semmle.label | *argv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -975,6 +975,45 @@ void test27(size_t s) {
975975
}
976976
}
977977

978+
bool cond();
979+
980+
void test28() {
981+
int arr[10];
982+
983+
int *ptr1 = arr;
984+
ptr1[-1] = 0; // BAD: underrun write
985+
ptr1++;
986+
ptr1[-1] = 0; // GOOD
987+
988+
int *ptr2 = arr;
989+
ptr2[-1] = 0; // BAD: underrun write
990+
*ptr2++;
991+
ptr2[-1] = 0; // GOOD
992+
993+
int *ptr3 = arr;
994+
ptr3[-1] = 0; // BAD: underrun write
995+
if (cond()) {
996+
ptr3++;
997+
}
998+
ptr3[-1] = 0; // GOOD (depending what cond() does)
999+
1000+
int *ptr4 = arr;
1001+
ptr4[-1] = 0; // BAD: underrun write
1002+
while (true) {
1003+
ptr4++;
1004+
if (cond()) break;
1005+
}
1006+
ptr4[-1] = 0; // GOOD
1007+
1008+
int *ptr5 = arr;
1009+
ptr5[-1] = 0; // BAD: underrun write
1010+
while (true) {
1011+
if (cond()) ptr5++;
1012+
if (cond()) break;
1013+
}
1014+
ptr5[-1] = 0; // GOOD (depending what cond() does)
1015+
}
1016+
9781017
int tests_main(int argc, char *argv[])
9791018
{
9801019
long long arr17[19];
@@ -1004,6 +1043,7 @@ int tests_main(int argc, char *argv[])
10041043
test25(argv[0]);
10051044
test26();
10061045
test27(argc);
1046+
test28();
10071047

10081048
return 0;
10091049
}

0 commit comments

Comments
 (0)