Skip to content

Commit 8cec884

Browse files
jketemajketema
authored
Merge pull request github#13701 from rdmarsh2/rdmarsh2/cpp/constant-array-overflow-tests-2
C++: more constant array off-by-one tests
2 parents 3fe99dc + 5eea8e4 commit 8cec884

File tree

2 files changed

+112
-0
lines changed

2 files changed

+112
-0
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,26 @@ edges
5555
| test.cpp:286:19:286:25 | buffer2 | test.cpp:286:19:286:25 | buffer2 |
5656
| test.cpp:289:19:289:25 | buffer3 | test.cpp:277:35:277:35 | p |
5757
| test.cpp:289:19:289:25 | buffer3 | test.cpp:289:19:289:25 | buffer3 |
58+
| test.cpp:292:25:292:27 | arr | test.cpp:299:16:299:21 | access to array |
59+
| test.cpp:292:25:292:27 | arr | test.cpp:299:16:299:21 | access to array |
60+
| test.cpp:306:20:306:23 | arr1 | test.cpp:292:25:292:27 | arr |
61+
| test.cpp:306:20:306:23 | arr1 | test.cpp:306:20:306:23 | arr1 |
62+
| test.cpp:309:20:309:23 | arr2 | test.cpp:292:25:292:27 | arr |
63+
| test.cpp:309:20:309:23 | arr2 | test.cpp:309:20:309:23 | arr2 |
64+
| test.cpp:319:19:319:22 | temp | test.cpp:319:19:319:27 | ... + ... |
65+
| test.cpp:319:19:319:22 | temp | test.cpp:324:23:324:32 | ... + ... |
66+
| test.cpp:319:19:319:27 | ... + ... | test.cpp:325:24:325:26 | end |
67+
| test.cpp:322:19:322:22 | temp | test.cpp:322:19:322:27 | ... + ... |
68+
| test.cpp:322:19:322:22 | temp | test.cpp:324:23:324:32 | ... + ... |
69+
| test.cpp:322:19:322:27 | ... + ... | test.cpp:325:24:325:26 | end |
70+
| test.cpp:324:23:324:26 | temp | test.cpp:324:23:324:32 | ... + ... |
71+
| test.cpp:324:23:324:32 | ... + ... | test.cpp:325:15:325:19 | temp2 |
72+
| test.cpp:351:9:351:11 | arr | test.cpp:351:9:351:14 | access to array |
73+
| test.cpp:351:9:351:11 | arr | test.cpp:351:18:351:25 | access to array |
74+
| test.cpp:351:18:351:20 | arr | test.cpp:351:9:351:14 | access to array |
75+
| test.cpp:351:18:351:20 | arr | test.cpp:351:18:351:25 | access to array |
76+
| test.cpp:351:29:351:31 | arr | test.cpp:351:9:351:14 | access to array |
77+
| test.cpp:351:29:351:31 | arr | test.cpp:351:18:351:25 | access to array |
5878
nodes
5979
| test.cpp:34:5:34:24 | access to array | semmle.label | access to array |
6080
| test.cpp:34:10:34:12 | buf | semmle.label | buf |
@@ -131,6 +151,27 @@ nodes
131151
| test.cpp:286:19:286:25 | buffer2 | semmle.label | buffer2 |
132152
| test.cpp:289:19:289:25 | buffer3 | semmle.label | buffer3 |
133153
| test.cpp:289:19:289:25 | buffer3 | semmle.label | buffer3 |
154+
| test.cpp:292:25:292:27 | arr | semmle.label | arr |
155+
| test.cpp:292:25:292:27 | arr | semmle.label | arr |
156+
| test.cpp:299:16:299:21 | access to array | semmle.label | access to array |
157+
| test.cpp:306:20:306:23 | arr1 | semmle.label | arr1 |
158+
| test.cpp:306:20:306:23 | arr1 | semmle.label | arr1 |
159+
| test.cpp:309:20:309:23 | arr2 | semmle.label | arr2 |
160+
| test.cpp:309:20:309:23 | arr2 | semmle.label | arr2 |
161+
| test.cpp:319:19:319:22 | temp | semmle.label | temp |
162+
| test.cpp:319:19:319:27 | ... + ... | semmle.label | ... + ... |
163+
| test.cpp:322:19:322:22 | temp | semmle.label | temp |
164+
| test.cpp:322:19:322:27 | ... + ... | semmle.label | ... + ... |
165+
| test.cpp:324:23:324:26 | temp | semmle.label | temp |
166+
| test.cpp:324:23:324:32 | ... + ... | semmle.label | ... + ... |
167+
| test.cpp:325:15:325:19 | temp2 | semmle.label | temp2 |
168+
| test.cpp:325:24:325:26 | end | semmle.label | end |
169+
| test.cpp:325:24:325:26 | end | semmle.label | end |
170+
| test.cpp:351:9:351:11 | arr | semmle.label | arr |
171+
| test.cpp:351:9:351:14 | access to array | semmle.label | access to array |
172+
| test.cpp:351:18:351:20 | arr | semmle.label | arr |
173+
| test.cpp:351:18:351:25 | access to array | semmle.label | access to array |
174+
| test.cpp:351:29:351:31 | arr | semmle.label | arr |
134175
subpaths
135176
#select
136177
| test.cpp:35:5:35:22 | PointerAdd: access to array | test.cpp:35:10:35:12 | buf | test.cpp:35:5:35:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:35:5:35:26 | Store: ... = ... | write |
@@ -149,3 +190,10 @@ subpaths
149190
| test.cpp:221:5:221:11 | PointerAdd: access to array | test.cpp:218:23:218:28 | buffer | test.cpp:221:5:221:11 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:217:19:217:24 | buffer | buffer | test.cpp:221:5:221:15 | Store: ... = ... | write |
150191
| test.cpp:232:5:232:10 | PointerAdd: access to array | test.cpp:229:25:229:29 | array | test.cpp:232:5:232:10 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:228:10:228:14 | array | array | test.cpp:232:5:232:19 | Store: ... = ... | write |
151192
| test.cpp:261:27:261:30 | PointerAdd: access to array | test.cpp:286:19:286:25 | buffer2 | test.cpp:261:27:261:30 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:285:19:285:25 | buffer2 | buffer2 | test.cpp:261:27:261:30 | Load: access to array | read |
193+
| test.cpp:299:16:299:21 | PointerAdd: access to array | test.cpp:309:20:309:23 | arr2 | test.cpp:299:16:299:21 | access to array | This pointer arithmetic may have an off-by-1014 error allowing it to overrun $@ at this $@. | test.cpp:308:9:308:12 | arr2 | arr2 | test.cpp:299:16:299:21 | Load: access to array | read |
194+
| test.cpp:322:19:322:27 | PointerAdd: ... + ... | test.cpp:322:19:322:22 | temp | test.cpp:325:24:325:26 | end | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:314:10:314:13 | temp | temp | test.cpp:330:13:330:24 | Store: ... = ... | write |
195+
| test.cpp:322:19:322:27 | PointerAdd: ... + ... | test.cpp:322:19:322:22 | temp | test.cpp:325:24:325:26 | end | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:314:10:314:13 | temp | temp | test.cpp:331:13:331:24 | Store: ... = ... | write |
196+
| test.cpp:322:19:322:27 | PointerAdd: ... + ... | test.cpp:322:19:322:22 | temp | test.cpp:325:24:325:26 | end | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:314:10:314:13 | temp | temp | test.cpp:333:13:333:24 | Store: ... = ... | write |
197+
| test.cpp:351:18:351:25 | PointerAdd: access to array | test.cpp:351:9:351:11 | arr | test.cpp:351:18:351:25 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:348:9:348:11 | arr | arr | test.cpp:351:18:351:25 | Load: access to array | read |
198+
| test.cpp:351:18:351:25 | PointerAdd: access to array | test.cpp:351:18:351:20 | arr | test.cpp:351:18:351:25 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:348:9:348:11 | arr | arr | test.cpp:351:18:351:25 | Load: access to array | read |
199+
| test.cpp:351:18:351:25 | PointerAdd: access to array | test.cpp:351:29:351:31 | arr | test.cpp:351:18:351:25 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:348:9:348:11 | arr | arr | test.cpp:351:18:351:25 | Load: access to array | read |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/test.cpp

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,3 +288,67 @@ void test_call_use2() {
288288
unsigned char buffer3[3];
289289
call_call_use(buffer3,3);
290290
}
291+
292+
int guardingCallee(int *arr, int size) {
293+
if (size > MAX_SIZE) {
294+
return -1;
295+
}
296+
297+
int sum;
298+
for (int i = 0; i < size; i++) {
299+
sum += arr[i]; // GOOD [FALSE POSITIVE] - guarded by size
300+
}
301+
return sum;
302+
}
303+
304+
int guardingCaller() {
305+
int arr1[MAX_SIZE];
306+
guardingCallee(arr1, MAX_SIZE);
307+
308+
int arr2[10];
309+
guardingCallee(arr2, 10);
310+
}
311+
312+
// simplified md5 padding
313+
void correlatedCondition(int num) {
314+
char temp[64];
315+
316+
char *end;
317+
if(num < 64) {
318+
if (num < 56) {
319+
end = temp + 56;
320+
}
321+
else if (num < 64) {
322+
end = temp + 64; // GOOD [FALSE POSITVE]
323+
}
324+
char *temp2 = temp + num;
325+
while(temp2 != end) {
326+
*temp2 = 0;
327+
temp2++;
328+
}
329+
if(num < 56) {
330+
temp2[0] = 0;
331+
temp2[1] = 0;
332+
// ...
333+
temp2[7] = 0;
334+
}
335+
}
336+
}
337+
338+
int positiveRange(int x) {
339+
if (x < 40) {
340+
return -1;
341+
}
342+
if (x > 1024) {
343+
return -1;
344+
}
345+
346+
int offset = (unsigned char)(x + 7)/8;
347+
348+
int arr[128];
349+
350+
for(int i=127-offset; i>= 0; i--) {
351+
arr[i] = arr[i+1] + arr[i+offset]; // GOOD [FALSE POSITIVE]
352+
}
353+
return arr[0];
354+
}

0 commit comments

Comments
 (0)