Skip to content

Commit 8c1c537

Browse files
am0o0am0o0
committed
finilize tests for zlib
1 parent f97b103 commit 8c1c537

File tree

4 files changed

+118
-3
lines changed

4 files changed

+118
-3
lines changed

‎cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {
2222

2323
predicate isSink(DataFlow::Node sink) {
2424
exists(FunctionCall fc, DecompressionFunction f | fc.getTarget() = f |
25-
fc.getArgument(f.getArchiveParameterIndex()) = sink.asExpr()
25+
fc.getArgument(f.getArchiveParameterIndex()) = [sink.asExpr(), sink.asIndirectExpr()]
2626
)
2727
}
2828

‎cpp/ql/src/experimental/query-tests/Security/CWE/CWE-409/ZlibUncompress.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,5 @@ import DecompressionBomb
1313
class UncompressFunction extends DecompressionFunction {
1414
UncompressFunction() { this.hasGlobalName(["uncompress", "uncompress2"]) }
1515

16-
override int getArchiveParameterIndex() { result = 0 }
16+
override int getArchiveParameterIndex() { result = 2 }
1717
}

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
edges
2+
| zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:63:25:63:35 | *a | provenance | |
3+
| zlibTest.cpp:63:25:63:35 | *a | zlibTest.cpp:52:25:52:25 | *a | provenance | |
4+
| zlibTest.cpp:63:25:63:35 | *a | zlibTest.cpp:69:17:69:26 | & ... | provenance | Config |
5+
| zlibTest.cpp:63:25:63:35 | *a | zlibTest.cpp:70:13:70:22 | & ... | provenance | Config |
6+
| zlibTest.cpp:69:17:69:26 | & ... | zlibTest.cpp:70:13:70:22 | & ... | provenance | |
7+
| zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:94:29:94:36 | *fileName | provenance | |
8+
| zlibTest.cpp:94:22:94:27 | call to gzopen | zlibTest.cpp:94:22:94:27 | call to gzopen | provenance | |
9+
| zlibTest.cpp:94:22:94:27 | call to gzopen | zlibTest.cpp:101:32:101:38 | inFileZ | provenance | |
10+
| zlibTest.cpp:94:29:94:36 | *fileName | zlibTest.cpp:93:24:93:31 | *fileName | provenance | |
11+
| zlibTest.cpp:94:29:94:36 | *fileName | zlibTest.cpp:94:22:94:27 | call to gzopen | provenance | Config |
12+
| zlibTest.cpp:114:25:114:32 | *fileName | zlibTest.cpp:115:29:115:36 | *fileName | provenance | |
13+
| zlibTest.cpp:115:22:115:27 | call to gzopen | zlibTest.cpp:115:22:115:27 | call to gzopen | provenance | |
14+
| zlibTest.cpp:115:22:115:27 | call to gzopen | zlibTest.cpp:121:38:121:44 | inFileZ | provenance | |
15+
| zlibTest.cpp:115:29:115:36 | *fileName | zlibTest.cpp:114:25:114:32 | *fileName | provenance | |
16+
| zlibTest.cpp:115:29:115:36 | *fileName | zlibTest.cpp:115:22:115:27 | call to gzopen | provenance | Config |
17+
| zlibTest.cpp:131:24:131:31 | *fileName | zlibTest.cpp:132:29:132:36 | *fileName | provenance | |
18+
| zlibTest.cpp:132:22:132:27 | call to gzopen | zlibTest.cpp:132:22:132:27 | call to gzopen | provenance | |
19+
| zlibTest.cpp:132:22:132:27 | call to gzopen | zlibTest.cpp:139:25:139:31 | inFileZ | provenance | |
20+
| zlibTest.cpp:132:29:132:36 | *fileName | zlibTest.cpp:131:24:131:31 | *fileName | provenance | |
21+
| zlibTest.cpp:132:29:132:36 | *fileName | zlibTest.cpp:132:22:132:27 | call to gzopen | provenance | Config |
22+
| zlibTest.cpp:156:41:156:45 | *input | zlibTest.cpp:163:29:163:43 | *input | provenance | |
23+
| zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:169:19:169:25 | *access to array | provenance | |
24+
| zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:170:18:170:24 | *access to array | provenance | |
25+
| zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:171:19:171:25 | *access to array | provenance | |
26+
| zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:172:18:172:24 | *access to array | provenance | |
27+
| zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:174:19:174:66 | *access to array | provenance | |
28+
| zlibTest.cpp:169:19:169:25 | *access to array | zlibTest.cpp:114:25:114:32 | *fileName | provenance | |
29+
| zlibTest.cpp:169:19:169:25 | *access to array | zlibTest.cpp:169:19:169:25 | UnsafeGzfread output argument | provenance | |
30+
| zlibTest.cpp:169:19:169:25 | UnsafeGzfread output argument | zlibTest.cpp:170:18:170:24 | *access to array | provenance | |
31+
| zlibTest.cpp:169:19:169:25 | UnsafeGzfread output argument | zlibTest.cpp:171:19:171:25 | *access to array | provenance | |
32+
| zlibTest.cpp:169:19:169:25 | UnsafeGzfread output argument | zlibTest.cpp:172:18:172:24 | *access to array | provenance | |
33+
| zlibTest.cpp:169:19:169:25 | UnsafeGzfread output argument | zlibTest.cpp:174:19:174:66 | *access to array | provenance | |
34+
| zlibTest.cpp:170:18:170:24 | *access to array | zlibTest.cpp:131:24:131:31 | *fileName | provenance | |
35+
| zlibTest.cpp:170:18:170:24 | *access to array | zlibTest.cpp:170:18:170:24 | UnsafeGzgets output argument | provenance | |
36+
| zlibTest.cpp:170:18:170:24 | UnsafeGzgets output argument | zlibTest.cpp:171:19:171:25 | *access to array | provenance | |
37+
| zlibTest.cpp:170:18:170:24 | UnsafeGzgets output argument | zlibTest.cpp:172:18:172:24 | *access to array | provenance | |
38+
| zlibTest.cpp:170:18:170:24 | UnsafeGzgets output argument | zlibTest.cpp:174:19:174:66 | *access to array | provenance | |
39+
| zlibTest.cpp:171:19:171:25 | *access to array | zlibTest.cpp:52:25:52:25 | *a | provenance | |
40+
| zlibTest.cpp:171:19:171:25 | *access to array | zlibTest.cpp:171:19:171:25 | UnsafeInflate output argument | provenance | |
41+
| zlibTest.cpp:171:19:171:25 | UnsafeInflate output argument | zlibTest.cpp:172:18:172:24 | *access to array | provenance | |
42+
| zlibTest.cpp:171:19:171:25 | UnsafeInflate output argument | zlibTest.cpp:174:19:174:66 | *access to array | provenance | |
43+
| zlibTest.cpp:172:18:172:24 | *access to array | zlibTest.cpp:93:24:93:31 | *fileName | provenance | |
44+
| zlibTest.cpp:172:18:172:24 | *access to array | zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | provenance | |
45+
| zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | zlibTest.cpp:174:19:174:66 | *access to array | provenance | |
46+
| zlibTest.cpp:174:19:174:66 | *access to array | zlibTest.cpp:156:41:156:45 | *input | provenance | |
47+
nodes
48+
| zlibTest.cpp:52:25:52:25 | *a | semmle.label | *a |
49+
| zlibTest.cpp:52:25:52:25 | *a | semmle.label | *a |
50+
| zlibTest.cpp:63:25:63:35 | *a | semmle.label | *a |
51+
| zlibTest.cpp:69:17:69:26 | & ... | semmle.label | & ... |
52+
| zlibTest.cpp:70:13:70:22 | & ... | semmle.label | & ... |
53+
| zlibTest.cpp:93:24:93:31 | *fileName | semmle.label | *fileName |
54+
| zlibTest.cpp:93:24:93:31 | *fileName | semmle.label | *fileName |
55+
| zlibTest.cpp:94:22:94:27 | call to gzopen | semmle.label | call to gzopen |
56+
| zlibTest.cpp:94:22:94:27 | call to gzopen | semmle.label | call to gzopen |
57+
| zlibTest.cpp:94:29:94:36 | *fileName | semmle.label | *fileName |
58+
| zlibTest.cpp:101:32:101:38 | inFileZ | semmle.label | inFileZ |
59+
| zlibTest.cpp:114:25:114:32 | *fileName | semmle.label | *fileName |
60+
| zlibTest.cpp:114:25:114:32 | *fileName | semmle.label | *fileName |
61+
| zlibTest.cpp:115:22:115:27 | call to gzopen | semmle.label | call to gzopen |
62+
| zlibTest.cpp:115:22:115:27 | call to gzopen | semmle.label | call to gzopen |
63+
| zlibTest.cpp:115:29:115:36 | *fileName | semmle.label | *fileName |
64+
| zlibTest.cpp:121:38:121:44 | inFileZ | semmle.label | inFileZ |
65+
| zlibTest.cpp:131:24:131:31 | *fileName | semmle.label | *fileName |
66+
| zlibTest.cpp:131:24:131:31 | *fileName | semmle.label | *fileName |
67+
| zlibTest.cpp:132:22:132:27 | call to gzopen | semmle.label | call to gzopen |
68+
| zlibTest.cpp:132:22:132:27 | call to gzopen | semmle.label | call to gzopen |
69+
| zlibTest.cpp:132:29:132:36 | *fileName | semmle.label | *fileName |
70+
| zlibTest.cpp:139:25:139:31 | inFileZ | semmle.label | inFileZ |
71+
| zlibTest.cpp:156:41:156:45 | *input | semmle.label | *input |
72+
| zlibTest.cpp:163:29:163:43 | *input | semmle.label | *input |
73+
| zlibTest.cpp:168:27:168:30 | **argv | semmle.label | **argv |
74+
| zlibTest.cpp:169:19:169:25 | *access to array | semmle.label | *access to array |
75+
| zlibTest.cpp:169:19:169:25 | UnsafeGzfread output argument | semmle.label | UnsafeGzfread output argument |
76+
| zlibTest.cpp:170:18:170:24 | *access to array | semmle.label | *access to array |
77+
| zlibTest.cpp:170:18:170:24 | UnsafeGzgets output argument | semmle.label | UnsafeGzgets output argument |
78+
| zlibTest.cpp:171:19:171:25 | *access to array | semmle.label | *access to array |
79+
| zlibTest.cpp:171:19:171:25 | UnsafeInflate output argument | semmle.label | UnsafeInflate output argument |
80+
| zlibTest.cpp:172:18:172:24 | *access to array | semmle.label | *access to array |
81+
| zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | semmle.label | UnsafeGzread output argument |
82+
| zlibTest.cpp:174:19:174:66 | *access to array | semmle.label | *access to array |
83+
subpaths
84+
| zlibTest.cpp:169:19:169:25 | *access to array | zlibTest.cpp:114:25:114:32 | *fileName | zlibTest.cpp:114:25:114:32 | *fileName | zlibTest.cpp:169:19:169:25 | UnsafeGzfread output argument |
85+
| zlibTest.cpp:170:18:170:24 | *access to array | zlibTest.cpp:131:24:131:31 | *fileName | zlibTest.cpp:131:24:131:31 | *fileName | zlibTest.cpp:170:18:170:24 | UnsafeGzgets output argument |
86+
| zlibTest.cpp:171:19:171:25 | *access to array | zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:171:19:171:25 | UnsafeInflate output argument |
87+
| zlibTest.cpp:172:18:172:24 | *access to array | zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument |
88+
#select
89+
| zlibTest.cpp:70:13:70:22 | & ... | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:70:13:70:22 | & ... | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
90+
| zlibTest.cpp:101:32:101:38 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:101:32:101:38 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
91+
| zlibTest.cpp:121:38:121:44 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:121:38:121:44 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
92+
| zlibTest.cpp:139:25:139:31 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:139:25:139:31 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
93+
| zlibTest.cpp:163:29:163:43 | *input | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:163:29:163:43 | *input | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/zlibTest.cpp

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
#define Z_NULL 0
32
# define FAR
43
typedef unsigned char Byte;
@@ -145,9 +144,32 @@ int UnsafeGzgets(char *fileName) {
145144
return 0;
146145
}
147146

147+
typedef unsigned long uLong;
148+
typedef long unsigned int size_t;
149+
typedef uLong uLongf;
150+
typedef unsigned char Bytef;
151+
#define Z_OK 0
152+
153+
int uncompress(Bytef *dest, uLongf *destLen,
154+
const Bytef *source, uLong sourceLen) { return 0; }
155+
156+
bool InflateString(const unsigned char *input, const unsigned char *output, size_t output_length) {
157+
uLong source_length;
158+
source_length = (uLong) 500;
159+
uLong destination_length;
160+
destination_length = (uLong) output_length;
161+
162+
int result = uncompress((Bytef *) output, &destination_length,
163+
(Bytef *) input, source_length);
164+
165+
return result == Z_OK;
166+
}
167+
148168
int main(int argc, char **argv) {
149169
UnsafeGzfread(argv[2]);
150170
UnsafeGzgets(argv[2]);
151171
UnsafeInflate(argv[2]);
152172
UnsafeGzread(argv[2]);
173+
const unsigned char *output;
174+
InflateString(reinterpret_cast<const unsigned char *>(argv[1]), output, 1024 * 1024 * 1024);
153175
}

0 commit comments

Comments
 (0)