Skip to content

Commit b948ed9

Browse files
MathiasVPMathiasVP
committed
C++: Accept test changes and add a few non-field flow tests to make up for the fact that we're no longer using field flow in the query.
1 parent 89b91ec commit b948ed9

File tree

4 files changed

+78
-107
lines changed

4 files changed

+78
-107
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-193/AllocationToInvalidPointer.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
failures
21
testFailures
2+
failures

‎cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerDeref.expected

Lines changed: 25 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -45,58 +45,6 @@ edges
4545
| test.cpp:53:5:53:23 | ... = ... | test.cpp:51:33:51:35 | end |
4646
| test.cpp:53:12:53:23 | ... + ... | test.cpp:53:5:53:23 | ... = ... |
4747
| test.cpp:60:34:60:37 | mk_array output argument | test.cpp:67:9:67:14 | ... = ... |
48-
| test.cpp:80:9:80:16 | mk_array indirection [end] | test.cpp:89:19:89:26 | call to mk_array [end] |
49-
| test.cpp:80:9:80:16 | mk_array indirection [end] | test.cpp:119:18:119:25 | call to mk_array [end] |
50-
| test.cpp:82:5:82:28 | ... = ... | test.cpp:82:9:82:13 | arr indirection [post update] [begin] |
51-
| test.cpp:82:9:82:13 | arr indirection [post update] [begin] | test.cpp:83:15:83:17 | arr indirection [begin] |
52-
| test.cpp:82:17:82:22 | call to malloc | test.cpp:82:5:82:28 | ... = ... |
53-
| test.cpp:83:5:83:30 | ... = ... | test.cpp:83:9:83:11 | arr indirection [post update] [end] |
54-
| test.cpp:83:9:83:11 | arr indirection [post update] [end] | test.cpp:80:9:80:16 | mk_array indirection [end] |
55-
| test.cpp:83:15:83:17 | arr indirection [begin] | test.cpp:83:19:83:23 | begin indirection |
56-
| test.cpp:83:15:83:30 | ... + ... | test.cpp:83:5:83:30 | ... = ... |
57-
| test.cpp:83:19:83:23 | begin indirection | test.cpp:83:5:83:30 | ... = ... |
58-
| test.cpp:83:19:83:23 | begin indirection | test.cpp:83:15:83:30 | ... + ... |
59-
| test.cpp:89:19:89:26 | call to mk_array [end] | test.cpp:91:36:91:38 | arr indirection [end] |
60-
| test.cpp:89:19:89:26 | call to mk_array [end] | test.cpp:95:36:95:38 | arr indirection [end] |
61-
| test.cpp:91:36:91:38 | arr indirection [end] | test.cpp:91:40:91:42 | end indirection |
62-
| test.cpp:91:36:91:38 | arr indirection [end] | test.cpp:96:9:96:14 | ... = ... |
63-
| test.cpp:91:40:91:42 | end indirection | test.cpp:96:9:96:14 | ... = ... |
64-
| test.cpp:95:36:95:38 | arr indirection [end] | test.cpp:95:40:95:42 | end indirection |
65-
| test.cpp:95:36:95:38 | arr indirection [end] | test.cpp:96:9:96:14 | ... = ... |
66-
| test.cpp:95:40:95:42 | end indirection | test.cpp:96:9:96:14 | ... = ... |
67-
| test.cpp:104:27:104:29 | arr [end] | test.cpp:105:36:105:38 | arr indirection [end] |
68-
| test.cpp:104:27:104:29 | arr [end] | test.cpp:109:36:109:38 | arr indirection [end] |
69-
| test.cpp:105:36:105:38 | arr indirection [end] | test.cpp:105:40:105:42 | end indirection |
70-
| test.cpp:105:36:105:38 | arr indirection [end] | test.cpp:110:9:110:14 | ... = ... |
71-
| test.cpp:105:40:105:42 | end indirection | test.cpp:110:9:110:14 | ... = ... |
72-
| test.cpp:109:36:109:38 | arr indirection [end] | test.cpp:109:40:109:42 | end indirection |
73-
| test.cpp:109:36:109:38 | arr indirection [end] | test.cpp:110:9:110:14 | ... = ... |
74-
| test.cpp:109:40:109:42 | end indirection | test.cpp:110:9:110:14 | ... = ... |
75-
| test.cpp:119:18:119:25 | call to mk_array [end] | test.cpp:104:27:104:29 | arr [end] |
76-
| test.cpp:141:10:141:19 | mk_array_p indirection [end] | test.cpp:150:20:150:29 | call to mk_array_p indirection [end] |
77-
| test.cpp:141:10:141:19 | mk_array_p indirection [end] | test.cpp:180:19:180:28 | call to mk_array_p indirection [end] |
78-
| test.cpp:143:5:143:29 | ... = ... | test.cpp:143:10:143:14 | arr indirection [post update] [begin] |
79-
| test.cpp:143:10:143:14 | arr indirection [post update] [begin] | test.cpp:144:16:144:18 | arr indirection [begin] |
80-
| test.cpp:143:18:143:23 | call to malloc | test.cpp:143:5:143:29 | ... = ... |
81-
| test.cpp:144:5:144:32 | ... = ... | test.cpp:144:10:144:12 | arr indirection [post update] [end] |
82-
| test.cpp:144:10:144:12 | arr indirection [post update] [end] | test.cpp:141:10:141:19 | mk_array_p indirection [end] |
83-
| test.cpp:144:16:144:18 | arr indirection [begin] | test.cpp:144:21:144:25 | begin indirection |
84-
| test.cpp:144:16:144:32 | ... + ... | test.cpp:144:5:144:32 | ... = ... |
85-
| test.cpp:144:21:144:25 | begin indirection | test.cpp:144:5:144:32 | ... = ... |
86-
| test.cpp:144:21:144:25 | begin indirection | test.cpp:144:16:144:32 | ... + ... |
87-
| test.cpp:150:20:150:29 | call to mk_array_p indirection [end] | test.cpp:156:37:156:39 | arr indirection [end] |
88-
| test.cpp:156:37:156:39 | arr indirection [end] | test.cpp:156:42:156:44 | end indirection |
89-
| test.cpp:156:37:156:39 | arr indirection [end] | test.cpp:157:9:157:14 | ... = ... |
90-
| test.cpp:156:42:156:44 | end indirection | test.cpp:157:9:157:14 | ... = ... |
91-
| test.cpp:165:29:165:31 | arr indirection [end] | test.cpp:166:37:166:39 | arr indirection [end] |
92-
| test.cpp:165:29:165:31 | arr indirection [end] | test.cpp:170:37:170:39 | arr indirection [end] |
93-
| test.cpp:166:37:166:39 | arr indirection [end] | test.cpp:166:42:166:44 | end indirection |
94-
| test.cpp:166:37:166:39 | arr indirection [end] | test.cpp:171:9:171:14 | ... = ... |
95-
| test.cpp:166:42:166:44 | end indirection | test.cpp:171:9:171:14 | ... = ... |
96-
| test.cpp:170:37:170:39 | arr indirection [end] | test.cpp:170:42:170:44 | end indirection |
97-
| test.cpp:170:37:170:39 | arr indirection [end] | test.cpp:171:9:171:14 | ... = ... |
98-
| test.cpp:170:42:170:44 | end indirection | test.cpp:171:9:171:14 | ... = ... |
99-
| test.cpp:180:19:180:28 | call to mk_array_p indirection [end] | test.cpp:165:29:165:31 | arr indirection [end] |
10048
| test.cpp:194:23:194:28 | call to malloc | test.cpp:195:17:195:23 | ... + ... |
10149
| test.cpp:194:23:194:28 | call to malloc | test.cpp:195:17:195:23 | ... + ... |
10250
| test.cpp:194:23:194:28 | call to malloc | test.cpp:201:5:201:19 | ... = ... |
@@ -233,6 +181,18 @@ edges
233181
| test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array |
234182
| test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array |
235183
| test.cpp:781:14:781:27 | new[] | test.cpp:786:18:786:27 | access to array |
184+
| test.cpp:792:60:792:62 | end | test.cpp:800:40:800:43 | mk_array_no_field_flow output argument |
185+
| test.cpp:792:60:792:62 | end | test.cpp:832:40:832:43 | mk_array_no_field_flow output argument |
186+
| test.cpp:793:14:793:19 | call to malloc | test.cpp:794:5:794:24 | ... = ... |
187+
| test.cpp:793:14:793:19 | call to malloc | test.cpp:794:12:794:24 | ... + ... |
188+
| test.cpp:794:5:794:24 | ... = ... | test.cpp:792:60:792:62 | end |
189+
| test.cpp:794:12:794:24 | ... + ... | test.cpp:794:5:794:24 | ... = ... |
190+
| test.cpp:800:40:800:43 | mk_array_no_field_flow output argument | test.cpp:807:7:807:12 | ... = ... |
191+
| test.cpp:815:52:815:54 | end | test.cpp:815:52:815:54 | end |
192+
| test.cpp:815:52:815:54 | end | test.cpp:821:7:821:12 | ... = ... |
193+
| test.cpp:815:52:815:54 | end | test.cpp:821:7:821:12 | ... = ... |
194+
| test.cpp:832:40:832:43 | mk_array_no_field_flow output argument | test.cpp:833:37:833:39 | end |
195+
| test.cpp:833:37:833:39 | end | test.cpp:815:52:815:54 | end |
236196
nodes
237197
| test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
238198
| test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... |
@@ -260,48 +220,6 @@ nodes
260220
| test.cpp:53:12:53:23 | ... + ... | semmle.label | ... + ... |
261221
| test.cpp:60:34:60:37 | mk_array output argument | semmle.label | mk_array output argument |
262222
| test.cpp:67:9:67:14 | ... = ... | semmle.label | ... = ... |
263-
| test.cpp:80:9:80:16 | mk_array indirection [end] | semmle.label | mk_array indirection [end] |
264-
| test.cpp:82:5:82:28 | ... = ... | semmle.label | ... = ... |
265-
| test.cpp:82:9:82:13 | arr indirection [post update] [begin] | semmle.label | arr indirection [post update] [begin] |
266-
| test.cpp:82:17:82:22 | call to malloc | semmle.label | call to malloc |
267-
| test.cpp:83:5:83:30 | ... = ... | semmle.label | ... = ... |
268-
| test.cpp:83:9:83:11 | arr indirection [post update] [end] | semmle.label | arr indirection [post update] [end] |
269-
| test.cpp:83:15:83:17 | arr indirection [begin] | semmle.label | arr indirection [begin] |
270-
| test.cpp:83:15:83:30 | ... + ... | semmle.label | ... + ... |
271-
| test.cpp:83:19:83:23 | begin indirection | semmle.label | begin indirection |
272-
| test.cpp:89:19:89:26 | call to mk_array [end] | semmle.label | call to mk_array [end] |
273-
| test.cpp:91:36:91:38 | arr indirection [end] | semmle.label | arr indirection [end] |
274-
| test.cpp:91:40:91:42 | end indirection | semmle.label | end indirection |
275-
| test.cpp:95:36:95:38 | arr indirection [end] | semmle.label | arr indirection [end] |
276-
| test.cpp:95:40:95:42 | end indirection | semmle.label | end indirection |
277-
| test.cpp:96:9:96:14 | ... = ... | semmle.label | ... = ... |
278-
| test.cpp:104:27:104:29 | arr [end] | semmle.label | arr [end] |
279-
| test.cpp:105:36:105:38 | arr indirection [end] | semmle.label | arr indirection [end] |
280-
| test.cpp:105:40:105:42 | end indirection | semmle.label | end indirection |
281-
| test.cpp:109:36:109:38 | arr indirection [end] | semmle.label | arr indirection [end] |
282-
| test.cpp:109:40:109:42 | end indirection | semmle.label | end indirection |
283-
| test.cpp:110:9:110:14 | ... = ... | semmle.label | ... = ... |
284-
| test.cpp:119:18:119:25 | call to mk_array [end] | semmle.label | call to mk_array [end] |
285-
| test.cpp:141:10:141:19 | mk_array_p indirection [end] | semmle.label | mk_array_p indirection [end] |
286-
| test.cpp:143:5:143:29 | ... = ... | semmle.label | ... = ... |
287-
| test.cpp:143:10:143:14 | arr indirection [post update] [begin] | semmle.label | arr indirection [post update] [begin] |
288-
| test.cpp:143:18:143:23 | call to malloc | semmle.label | call to malloc |
289-
| test.cpp:144:5:144:32 | ... = ... | semmle.label | ... = ... |
290-
| test.cpp:144:10:144:12 | arr indirection [post update] [end] | semmle.label | arr indirection [post update] [end] |
291-
| test.cpp:144:16:144:18 | arr indirection [begin] | semmle.label | arr indirection [begin] |
292-
| test.cpp:144:16:144:32 | ... + ... | semmle.label | ... + ... |
293-
| test.cpp:144:21:144:25 | begin indirection | semmle.label | begin indirection |
294-
| test.cpp:150:20:150:29 | call to mk_array_p indirection [end] | semmle.label | call to mk_array_p indirection [end] |
295-
| test.cpp:156:37:156:39 | arr indirection [end] | semmle.label | arr indirection [end] |
296-
| test.cpp:156:42:156:44 | end indirection | semmle.label | end indirection |
297-
| test.cpp:157:9:157:14 | ... = ... | semmle.label | ... = ... |
298-
| test.cpp:165:29:165:31 | arr indirection [end] | semmle.label | arr indirection [end] |
299-
| test.cpp:166:37:166:39 | arr indirection [end] | semmle.label | arr indirection [end] |
300-
| test.cpp:166:42:166:44 | end indirection | semmle.label | end indirection |
301-
| test.cpp:170:37:170:39 | arr indirection [end] | semmle.label | arr indirection [end] |
302-
| test.cpp:170:42:170:44 | end indirection | semmle.label | end indirection |
303-
| test.cpp:171:9:171:14 | ... = ... | semmle.label | ... = ... |
304-
| test.cpp:180:19:180:28 | call to mk_array_p indirection [end] | semmle.label | call to mk_array_p indirection [end] |
305223
| test.cpp:194:23:194:28 | call to malloc | semmle.label | call to malloc |
306224
| test.cpp:195:17:195:23 | ... + ... | semmle.label | ... + ... |
307225
| test.cpp:195:17:195:23 | ... + ... | semmle.label | ... + ... |
@@ -394,6 +312,17 @@ nodes
394312
| test.cpp:772:16:772:29 | access to array | semmle.label | access to array |
395313
| test.cpp:781:14:781:27 | new[] | semmle.label | new[] |
396314
| test.cpp:786:18:786:27 | access to array | semmle.label | access to array |
315+
| test.cpp:792:60:792:62 | end | semmle.label | end |
316+
| test.cpp:793:14:793:19 | call to malloc | semmle.label | call to malloc |
317+
| test.cpp:794:5:794:24 | ... = ... | semmle.label | ... = ... |
318+
| test.cpp:794:12:794:24 | ... + ... | semmle.label | ... + ... |
319+
| test.cpp:800:40:800:43 | mk_array_no_field_flow output argument | semmle.label | mk_array_no_field_flow output argument |
320+
| test.cpp:807:7:807:12 | ... = ... | semmle.label | ... = ... |
321+
| test.cpp:815:52:815:54 | end | semmle.label | end |
322+
| test.cpp:815:52:815:54 | end | semmle.label | end |
323+
| test.cpp:821:7:821:12 | ... = ... | semmle.label | ... = ... |
324+
| test.cpp:832:40:832:43 | mk_array_no_field_flow output argument | semmle.label | mk_array_no_field_flow output argument |
325+
| test.cpp:833:37:833:39 | end | semmle.label | end |
397326
subpaths
398327
#select
399328
| test.cpp:6:14:6:15 | * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -404,10 +333,6 @@ subpaths
404333
| test.cpp:42:14:42:15 | * ... | test.cpp:40:15:40:20 | call to malloc | test.cpp:42:14:42:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:40:15:40:20 | call to malloc | call to malloc | test.cpp:41:20:41:27 | ... - ... | ... - ... |
405334
| test.cpp:44:14:44:21 | * ... | test.cpp:40:15:40:20 | call to malloc | test.cpp:44:14:44:21 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:40:15:40:20 | call to malloc | call to malloc | test.cpp:41:20:41:27 | ... - ... | ... - ... |
406335
| test.cpp:67:9:67:14 | ... = ... | test.cpp:52:19:52:24 | call to malloc | test.cpp:67:9:67:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:52:19:52:24 | call to malloc | call to malloc | test.cpp:53:20:53:23 | size | size |
407-
| test.cpp:96:9:96:14 | ... = ... | test.cpp:82:17:82:22 | call to malloc | test.cpp:96:9:96:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:82:17:82:22 | call to malloc | call to malloc | test.cpp:83:27:83:30 | size | size |
408-
| test.cpp:110:9:110:14 | ... = ... | test.cpp:82:17:82:22 | call to malloc | test.cpp:110:9:110:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:82:17:82:22 | call to malloc | call to malloc | test.cpp:83:27:83:30 | size | size |
409-
| test.cpp:157:9:157:14 | ... = ... | test.cpp:143:18:143:23 | call to malloc | test.cpp:157:9:157:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:143:18:143:23 | call to malloc | call to malloc | test.cpp:144:29:144:32 | size | size |
410-
| test.cpp:171:9:171:14 | ... = ... | test.cpp:143:18:143:23 | call to malloc | test.cpp:171:9:171:14 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:143:18:143:23 | call to malloc | call to malloc | test.cpp:144:29:144:32 | size | size |
411336
| test.cpp:201:5:201:19 | ... = ... | test.cpp:194:23:194:28 | call to malloc | test.cpp:201:5:201:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:194:23:194:28 | call to malloc | call to malloc | test.cpp:195:21:195:23 | len | len |
412337
| test.cpp:213:5:213:13 | ... = ... | test.cpp:205:23:205:28 | call to malloc | test.cpp:213:5:213:13 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:205:23:205:28 | call to malloc | call to malloc | test.cpp:206:21:206:23 | len | len |
413338
| test.cpp:232:3:232:20 | ... = ... | test.cpp:231:18:231:30 | new[] | test.cpp:232:3:232:20 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:231:18:231:30 | new[] | new[] | test.cpp:232:11:232:15 | index | index |
@@ -434,3 +359,5 @@ subpaths
434359
| test.cpp:772:16:772:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:767:22:767:28 | ... + ... | ... + ... |
435360
| test.cpp:772:16:772:29 | access to array | test.cpp:754:18:754:31 | new[] | test.cpp:772:16:772:29 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:754:18:754:31 | new[] | new[] | test.cpp:772:22:772:28 | ... + ... | ... + ... |
436361
| test.cpp:786:18:786:27 | access to array | test.cpp:781:14:781:27 | new[] | test.cpp:786:18:786:27 | access to array | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:781:14:781:27 | new[] | new[] | test.cpp:786:20:786:26 | ... + ... | ... + ... |
362+
| test.cpp:807:7:807:12 | ... = ... | test.cpp:793:14:793:19 | call to malloc | test.cpp:807:7:807:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:19 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size |
363+
| test.cpp:821:7:821:12 | ... = ... | test.cpp:793:14:793:19 | call to malloc | test.cpp:821:7:821:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:793:14:793:19 | call to malloc | call to malloc | test.cpp:794:21:794:24 | size | size |

‎cpp/ql/test/query-tests/Security/CWE/CWE-193/InvalidPointerToDereference.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
failures
21
testFailures
2+
failures

‎cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp

Lines changed: 51 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ struct array_t {
8080
array_t mk_array(int size) {
8181
array_t arr;
8282
arr.begin = malloc(size);
83-
arr.end = arr.begin + size; // $ alloc=L82
83+
arr.end = arr.begin + size; // $ MISSING: alloc=L82
8484

8585
return arr;
8686
}
@@ -93,7 +93,7 @@ void test6(int size) {
9393
}
9494

9595
for (char* p = arr.begin; p <= arr.end; ++p) {
96-
*p = 0; // $ deref=L83->L91->L96 deref=L83->L95->L96 // BAD
96+
*p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 // BAD [NOT DETECTED]
9797
}
9898

9999
for (char* p = arr.begin; p < arr.end; ++p) {
@@ -107,7 +107,7 @@ void test7_callee(array_t arr) {
107107
}
108108

109109
for (char* p = arr.begin; p <= arr.end; ++p) {
110-
*p = 0; // $ deref=L83->L105->L110 deref=L83->L109->L110 // BAD
110+
*p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 // BAD [NOT DETECTED]
111111
}
112112

113113
for (char* p = arr.begin; p < arr.end; ++p) {
@@ -141,7 +141,7 @@ void test8(int size) {
141141
array_t *mk_array_p(int size) {
142142
array_t *arr = (array_t*) malloc(sizeof(array_t));
143143
arr->begin = malloc(size);
144-
arr->end = arr->begin + size; // $ alloc=L143
144+
arr->end = arr->begin + size; // $ MISSING: alloc=L143
145145

146146
return arr;
147147
}
@@ -154,7 +154,7 @@ void test9(int size) {
154154
}
155155

156156
for (char* p = arr->begin; p <= arr->end; ++p) {
157-
*p = 0; // $ deref=L144->L156->L157 // BAD
157+
*p = 0; // $ MISSING: deref=L144->L156->L157 // BAD [NOT DETECTED]
158158
}
159159

160160
for (char* p = arr->begin; p < arr->end; ++p) {
@@ -168,7 +168,7 @@ void test10_callee(array_t *arr) {
168168
}
169169

170170
for (char* p = arr->begin; p <= arr->end; ++p) {
171-
*p = 0; // $ deref=L144->L166->L171 deref=L144->L170->L171 // BAD
171+
*p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 // BAD [NOT DETECTED]
172172
}
173173

174174
for (char* p = arr->begin; p < arr->end; ++p) {
@@ -787,4 +787,48 @@ void test38_simple(unsigned size, unsigned pos, unsigned numParams) {
787787
}
788788
}
789789
}
790-
}
790+
}
791+
792+
void mk_array_no_field_flow(int size, char** begin, char** end) {
793+
*begin = malloc(size);
794+
*end = *begin + size; // $ alloc=L793
795+
}
796+
797+
void test6_no_field_flow(int size) {
798+
char* begin;
799+
char* end;
800+
mk_array_no_field_flow(size, &begin, &end);
801+
802+
for (char* p = begin; p != end; ++p) {
803+
*p = 0; // GOOD
804+
}
805+
806+
for (char* p = begin; p <= end; ++p) {
807+
*p = 0; // $ deref=L794->L802->L807 deref=L794->L806->L807 // BAD
808+
}
809+
810+
for (char* p = begin; p < end; ++p) {
811+
*p = 0; // GOOD
812+
}
813+
}
814+
815+
void test7_callee_no_field_flow(char* begin, char* end) {
816+
for (char* p = begin; p != end; ++p) {
817+
*p = 0; // GOOD
818+
}
819+
820+
for (char* p = begin; p <= end; ++p) {
821+
*p = 0; // $ deref=L794->L815->L821 deref=L794->L816->L821 deref=L794->L820->L821 // BAD
822+
}
823+
824+
for (char* p = begin; p < end; ++p) {
825+
*p = 0; // GOOD
826+
}
827+
}
828+
829+
void test7_no_field_flow(int size) {
830+
char* begin;
831+
char* end;
832+
mk_array_no_field_flow(size, &begin, &end);
833+
test7_callee_no_field_flow(begin, end);
834+
}

0 commit comments

Comments
 (0)