Skip to content

Commit 90f0209

Browse files
jketemajketema
committed
C++: Add cpp/invalid-pointer-deref test case with almost duplicated results
1 parent 41bd1ae commit 90f0209

File tree

2 files changed

+47
-0
lines changed

2 files changed

+47
-0
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -732,6 +732,29 @@ edges
732732
| test.cpp:368:5:368:10 | ... += ... | test.cpp:372:16:372:16 | p |
733733
| test.cpp:371:7:371:7 | p | test.cpp:372:15:372:16 | Load: * ... |
734734
| test.cpp:372:16:372:16 | p | test.cpp:372:15:372:16 | Load: * ... |
735+
| test.cpp:377:14:377:27 | new[] | test.cpp:378:15:378:16 | xs |
736+
| test.cpp:378:15:378:16 | xs | test.cpp:378:15:378:23 | ... + ... |
737+
| test.cpp:378:15:378:16 | xs | test.cpp:378:15:378:23 | ... + ... |
738+
| test.cpp:378:15:378:16 | xs | test.cpp:378:15:378:23 | ... + ... |
739+
| test.cpp:378:15:378:16 | xs | test.cpp:378:15:378:23 | ... + ... |
740+
| test.cpp:378:15:378:16 | xs | test.cpp:381:5:381:7 | end |
741+
| test.cpp:378:15:378:16 | xs | test.cpp:381:5:381:9 | ... ++ |
742+
| test.cpp:378:15:378:16 | xs | test.cpp:381:5:381:9 | ... ++ |
743+
| test.cpp:378:15:378:16 | xs | test.cpp:384:14:384:16 | end |
744+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:378:15:378:23 | ... + ... |
745+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:378:15:378:23 | ... + ... |
746+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:381:5:381:7 | end |
747+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:381:5:381:7 | end |
748+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:384:13:384:16 | Load: * ... |
749+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:384:13:384:16 | Load: * ... |
750+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:384:13:384:16 | Load: * ... |
751+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:384:13:384:16 | Load: * ... |
752+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:384:14:384:16 | end |
753+
| test.cpp:378:15:378:23 | ... + ... | test.cpp:384:14:384:16 | end |
754+
| test.cpp:381:5:381:7 | end | test.cpp:384:13:384:16 | Load: * ... |
755+
| test.cpp:381:5:381:9 | ... ++ | test.cpp:384:14:384:16 | end |
756+
| test.cpp:381:5:381:9 | ... ++ | test.cpp:384:14:384:16 | end |
757+
| test.cpp:384:14:384:16 | end | test.cpp:384:13:384:16 | Load: * ... |
735758
nodes
736759
| test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
737760
| test.cpp:5:15:5:15 | p | semmle.label | p |
@@ -1066,6 +1089,17 @@ nodes
10661089
| test.cpp:371:7:371:7 | p | semmle.label | p |
10671090
| test.cpp:372:15:372:16 | Load: * ... | semmle.label | Load: * ... |
10681091
| test.cpp:372:16:372:16 | p | semmle.label | p |
1092+
| test.cpp:377:14:377:27 | new[] | semmle.label | new[] |
1093+
| test.cpp:378:15:378:16 | xs | semmle.label | xs |
1094+
| test.cpp:378:15:378:23 | ... + ... | semmle.label | ... + ... |
1095+
| test.cpp:378:15:378:23 | ... + ... | semmle.label | ... + ... |
1096+
| test.cpp:378:15:378:23 | ... + ... | semmle.label | ... + ... |
1097+
| test.cpp:378:15:378:23 | ... + ... | semmle.label | ... + ... |
1098+
| test.cpp:381:5:381:7 | end | semmle.label | end |
1099+
| test.cpp:381:5:381:9 | ... ++ | semmle.label | ... ++ |
1100+
| test.cpp:381:5:381:9 | ... ++ | semmle.label | ... ++ |
1101+
| test.cpp:384:13:384:16 | Load: * ... | semmle.label | Load: * ... |
1102+
| test.cpp:384:14:384:16 | end | semmle.label | end |
10691103
subpaths
10701104
#select
10711105
| test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -1094,3 +1128,5 @@ subpaths
10941128
| test.cpp:358:14:358:26 | Load: * ... | test.cpp:355:14:355:27 | new[] | test.cpp:358:14:358:26 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size |
10951129
| test.cpp:359:14:359:32 | Load: * ... | test.cpp:355:14:355:27 | new[] | test.cpp:359:14:359:32 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 2. | test.cpp:355:14:355:27 | new[] | new[] | test.cpp:356:20:356:23 | size | size |
10961130
| test.cpp:372:15:372:16 | Load: * ... | test.cpp:363:14:363:27 | new[] | test.cpp:372:15:372:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:363:14:363:27 | new[] | new[] | test.cpp:365:19:365:22 | size | size |
1131+
| test.cpp:384:13:384:16 | Load: * ... | test.cpp:377:14:377:27 | new[] | test.cpp:384:13:384:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:377:14:377:27 | new[] | new[] | test.cpp:378:20:378:23 | size | size |
1132+
| test.cpp:384:13:384:16 | Load: * ... | test.cpp:377:14:377:27 | new[] | test.cpp:384:13:384:16 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:377:14:377:27 | new[] | new[] | test.cpp:378:20:378:23 | size | size |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -372,3 +372,14 @@ void test26(unsigned size) {
372372
int val = *p; // GOOD [FALSE POSITIVE]
373373
}
374374
}
375+
376+
void test27(unsigned size, bool b) {
377+
char *xs = new char[size];
378+
char *end = xs + size;
379+
380+
if (b) {
381+
end++;
382+
}
383+
384+
int val = *end; // BAD
385+
}

0 commit comments

Comments
 (0)