Skip to content

Commit bf07b0f

Browse files
rdmarsh2rdmarsh2
committed
C++: fix cxartesian product in constant off-by-one query
1 parent 584adf8 commit bf07b0f

File tree

2 files changed

+38
-71
lines changed

2 files changed

+38
-71
lines changed

‎cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,18 @@ predicate pointerArithOverflow(
8787
delta = bound - size
8888
}
8989

90+
module PointerArithmeticToDerefConfig implements DataFlow::ConfigSig {
91+
predicate isSource(DataFlow::Node source) {
92+
pointerArithOverflow(source.asInstruction(), _, _, _, _)
93+
}
94+
95+
predicate isSink(DataFlow::Node sink) {
96+
isInvalidPointerDerefSink1(sink, _, _)
97+
}
98+
}
99+
100+
module PointerArithmeticToDerefFlow = DataFlow::Global<PointerArithmeticToDerefConfig>;
101+
90102
module FieldAddressToDerefConfig implements DataFlow::StateConfigSig {
91103
newtype FlowState =
92104
additional TArray(Field f) { pointerArithOverflow(_, f, _, _, _) } or
@@ -101,9 +113,12 @@ module FieldAddressToDerefConfig implements DataFlow::StateConfigSig {
101113
)
102114
}
103115

116+
pragma[inline]
104117
predicate isSink(DataFlow::Node sink, FlowState state) {
105-
isInvalidPointerDerefSink1(sink, _, _) and
106-
state instanceof TOverflowArithmetic
118+
exists(DataFlow::Node pai |
119+
state = TOverflowArithmetic(pai.asInstruction()) and
120+
PointerArithmeticToDerefFlow::flow(pai, sink)
121+
)
107122
}
108123

109124
predicate isBarrier(DataFlow::Node node, FlowState state) { none() }

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected

Lines changed: 21 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,72 +1,33 @@
11
edges
2-
| test.cpp:26:10:26:12 | buf | test.cpp:26:5:26:12 | buf |
3-
| test.cpp:30:10:30:12 | buf | test.cpp:30:5:30:12 | buf |
4-
| test.cpp:34:10:34:12 | buf | test.cpp:34:5:34:12 | buf |
5-
| test.cpp:35:5:35:12 | buf | test.cpp:35:5:35:22 | access to array |
6-
| test.cpp:35:10:35:12 | buf | test.cpp:35:5:35:12 | buf |
7-
| test.cpp:36:5:36:12 | buf | test.cpp:36:5:36:24 | access to array |
8-
| test.cpp:36:10:36:12 | buf | test.cpp:36:5:36:12 | buf |
9-
| test.cpp:39:14:39:16 | buf | test.cpp:39:9:39:16 | buf |
10-
| test.cpp:43:9:43:16 | buf | test.cpp:43:9:43:19 | access to array |
11-
| test.cpp:43:14:43:16 | buf | test.cpp:43:9:43:16 | buf |
12-
| test.cpp:48:10:48:12 | buf | test.cpp:48:5:48:12 | buf |
13-
| test.cpp:49:5:49:12 | buf | test.cpp:49:5:49:22 | access to array |
14-
| test.cpp:49:10:49:12 | buf | test.cpp:49:5:49:12 | buf |
15-
| test.cpp:50:5:50:12 | buf | test.cpp:50:5:50:24 | access to array |
16-
| test.cpp:50:10:50:12 | buf | test.cpp:50:5:50:12 | buf |
17-
| test.cpp:53:14:53:16 | buf | test.cpp:53:9:53:16 | buf |
18-
| test.cpp:57:9:57:16 | buf | test.cpp:57:9:57:19 | access to array |
19-
| test.cpp:57:14:57:16 | buf | test.cpp:57:9:57:16 | buf |
20-
| test.cpp:61:9:61:16 | buf | test.cpp:61:9:61:19 | access to array |
21-
| test.cpp:61:14:61:16 | buf | test.cpp:61:9:61:16 | buf |
2+
| test.cpp:35:10:35:12 | buf | test.cpp:35:5:35:22 | access to array |
3+
| test.cpp:36:10:36:12 | buf | test.cpp:36:5:36:24 | access to array |
4+
| test.cpp:43:14:43:16 | buf | test.cpp:43:9:43:19 | access to array |
5+
| test.cpp:49:10:49:12 | buf | test.cpp:49:5:49:22 | access to array |
6+
| test.cpp:50:10:50:12 | buf | test.cpp:50:5:50:24 | access to array |
7+
| test.cpp:57:14:57:16 | buf | test.cpp:57:9:57:19 | access to array |
8+
| test.cpp:61:14:61:16 | buf | test.cpp:61:9:61:19 | access to array |
229
| test.cpp:66:32:66:32 | p | test.cpp:66:32:66:32 | p |
2310
| test.cpp:66:32:66:32 | p | test.cpp:67:5:67:6 | * ... |
2411
| test.cpp:66:32:66:32 | p | test.cpp:67:6:67:6 | p |
25-
| test.cpp:70:33:70:33 | p | test.cpp:71:5:71:5 | p |
26-
| test.cpp:70:33:70:33 | p | test.cpp:72:5:72:5 | p |
27-
| test.cpp:72:5:72:5 | p | test.cpp:72:5:72:15 | access to array |
28-
| test.cpp:76:32:76:34 | buf | test.cpp:76:27:76:34 | buf |
12+
| test.cpp:70:33:70:33 | p | test.cpp:72:5:72:15 | access to array |
2913
| test.cpp:77:26:77:44 | & ... | test.cpp:66:32:66:32 | p |
3014
| test.cpp:77:26:77:44 | & ... | test.cpp:66:32:66:32 | p |
31-
| test.cpp:77:27:77:34 | buf | test.cpp:77:27:77:44 | access to array |
32-
| test.cpp:77:27:77:44 | access to array | test.cpp:77:26:77:44 | & ... |
33-
| test.cpp:77:32:77:34 | buf | test.cpp:77:27:77:34 | buf |
15+
| test.cpp:77:32:77:34 | buf | test.cpp:77:26:77:44 | & ... |
3416
| test.cpp:79:27:79:34 | buf | test.cpp:70:33:70:33 | p |
3517
| test.cpp:79:32:79:34 | buf | test.cpp:79:27:79:34 | buf |
36-
| test.cpp:85:34:85:36 | buf | test.cpp:87:5:87:11 | charBuf |
37-
| test.cpp:85:34:85:36 | buf | test.cpp:88:5:88:11 | charBuf |
3818
nodes
39-
| test.cpp:26:5:26:12 | buf | semmle.label | buf |
40-
| test.cpp:26:10:26:12 | buf | semmle.label | buf |
41-
| test.cpp:30:5:30:12 | buf | semmle.label | buf |
42-
| test.cpp:30:10:30:12 | buf | semmle.label | buf |
43-
| test.cpp:34:5:34:12 | buf | semmle.label | buf |
44-
| test.cpp:34:10:34:12 | buf | semmle.label | buf |
45-
| test.cpp:35:5:35:12 | buf | semmle.label | buf |
4619
| test.cpp:35:5:35:22 | access to array | semmle.label | access to array |
4720
| test.cpp:35:10:35:12 | buf | semmle.label | buf |
48-
| test.cpp:36:5:36:12 | buf | semmle.label | buf |
4921
| test.cpp:36:5:36:24 | access to array | semmle.label | access to array |
5022
| test.cpp:36:10:36:12 | buf | semmle.label | buf |
51-
| test.cpp:39:9:39:16 | buf | semmle.label | buf |
52-
| test.cpp:39:14:39:16 | buf | semmle.label | buf |
53-
| test.cpp:43:9:43:16 | buf | semmle.label | buf |
5423
| test.cpp:43:9:43:19 | access to array | semmle.label | access to array |
5524
| test.cpp:43:14:43:16 | buf | semmle.label | buf |
56-
| test.cpp:48:5:48:12 | buf | semmle.label | buf |
57-
| test.cpp:48:10:48:12 | buf | semmle.label | buf |
58-
| test.cpp:49:5:49:12 | buf | semmle.label | buf |
5925
| test.cpp:49:5:49:22 | access to array | semmle.label | access to array |
6026
| test.cpp:49:10:49:12 | buf | semmle.label | buf |
61-
| test.cpp:50:5:50:12 | buf | semmle.label | buf |
6227
| test.cpp:50:5:50:24 | access to array | semmle.label | access to array |
6328
| test.cpp:50:10:50:12 | buf | semmle.label | buf |
64-
| test.cpp:53:9:53:16 | buf | semmle.label | buf |
65-
| test.cpp:53:14:53:16 | buf | semmle.label | buf |
66-
| test.cpp:57:9:57:16 | buf | semmle.label | buf |
6729
| test.cpp:57:9:57:19 | access to array | semmle.label | access to array |
6830
| test.cpp:57:14:57:16 | buf | semmle.label | buf |
69-
| test.cpp:61:9:61:16 | buf | semmle.label | buf |
7031
| test.cpp:61:9:61:19 | access to array | semmle.label | access to array |
7132
| test.cpp:61:14:61:16 | buf | semmle.label | buf |
7233
| test.cpp:66:32:66:32 | p | semmle.label | p |
@@ -75,31 +36,22 @@ nodes
7536
| test.cpp:67:5:67:6 | * ... | semmle.label | * ... |
7637
| test.cpp:67:6:67:6 | p | semmle.label | p |
7738
| test.cpp:70:33:70:33 | p | semmle.label | p |
78-
| test.cpp:71:5:71:5 | p | semmle.label | p |
79-
| test.cpp:72:5:72:5 | p | semmle.label | p |
8039
| test.cpp:72:5:72:15 | access to array | semmle.label | access to array |
81-
| test.cpp:76:27:76:34 | buf | semmle.label | buf |
82-
| test.cpp:76:32:76:34 | buf | semmle.label | buf |
8340
| test.cpp:77:26:77:44 | & ... | semmle.label | & ... |
84-
| test.cpp:77:27:77:34 | buf | semmle.label | buf |
85-
| test.cpp:77:27:77:44 | access to array | semmle.label | access to array |
8641
| test.cpp:77:32:77:34 | buf | semmle.label | buf |
8742
| test.cpp:79:27:79:34 | buf | semmle.label | buf |
8843
| test.cpp:79:32:79:34 | buf | semmle.label | buf |
89-
| test.cpp:85:34:85:36 | buf | semmle.label | buf |
90-
| test.cpp:87:5:87:11 | charBuf | semmle.label | charBuf |
91-
| test.cpp:88:5:88:11 | charBuf | semmle.label | charBuf |
9244
subpaths
9345
#select
94-
| test.cpp:35:5:35:22 | access to array | test.cpp:35:10:35:12 | buf | test.cpp:35:5:35:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:35:5:35:26 | Store: ... = ... | write |
95-
| test.cpp:36:5:36:24 | access to array | test.cpp:36:10:36:12 | buf | test.cpp:36:5:36:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:36:5:36:28 | Store: ... = ... | write |
96-
| test.cpp:43:9:43:19 | access to array | test.cpp:43:14:43:16 | buf | test.cpp:43:9:43:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:43:9:43:23 | Store: ... = ... | write |
97-
| test.cpp:49:5:49:22 | access to array | test.cpp:49:10:49:12 | buf | test.cpp:49:5:49:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:49:5:49:26 | Store: ... = ... | write |
98-
| test.cpp:50:5:50:24 | access to array | test.cpp:50:10:50:12 | buf | test.cpp:50:5:50:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:50:5:50:28 | Store: ... = ... | write |
99-
| test.cpp:57:9:57:19 | access to array | test.cpp:57:14:57:16 | buf | test.cpp:57:9:57:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:57:9:57:23 | Store: ... = ... | write |
100-
| test.cpp:61:9:61:19 | access to array | test.cpp:61:14:61:16 | buf | test.cpp:61:9:61:19 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:61:9:61:23 | Store: ... = ... | write |
101-
| test.cpp:72:5:72:15 | access to array | test.cpp:79:32:79:34 | buf | test.cpp:72:5:72:15 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:72:5:72:19 | Store: ... = ... | write |
102-
| test.cpp:77:27:77:44 | access to array | test.cpp:77:32:77:34 | buf | test.cpp:66:32:66:32 | p | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
103-
| test.cpp:77:27:77:44 | access to array | test.cpp:77:32:77:34 | buf | test.cpp:66:32:66:32 | p | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
104-
| test.cpp:77:27:77:44 | access to array | test.cpp:77:32:77:34 | buf | test.cpp:67:5:67:6 | * ... | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
105-
| test.cpp:77:27:77:44 | access to array | test.cpp:77:32:77:34 | buf | test.cpp:67:6:67:6 | p | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
46+
| test.cpp:35:5:35:22 | PointerAdd: access to array | test.cpp:35:10:35:12 | buf | test.cpp:35:5:35:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:35:5:35:26 | Store: ... = ... | write |
47+
| test.cpp:36:5:36:24 | PointerAdd: access to array | test.cpp:36:10:36:12 | buf | test.cpp:36:5:36:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:36:5:36:28 | Store: ... = ... | write |
48+
| test.cpp:43:9:43:19 | PointerAdd: access to array | test.cpp:43:14:43:16 | buf | test.cpp:43:9:43:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:43:9:43:23 | Store: ... = ... | write |
49+
| test.cpp:49:5:49:22 | PointerAdd: access to array | test.cpp:49:10:49:12 | buf | test.cpp:49:5:49:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:49:5:49:26 | Store: ... = ... | write |
50+
| test.cpp:50:5:50:24 | PointerAdd: access to array | test.cpp:50:10:50:12 | buf | test.cpp:50:5:50:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:50:5:50:28 | Store: ... = ... | write |
51+
| test.cpp:57:9:57:19 | PointerAdd: access to array | test.cpp:57:14:57:16 | buf | test.cpp:57:9:57:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:57:9:57:23 | Store: ... = ... | write |
52+
| test.cpp:61:9:61:19 | PointerAdd: access to array | test.cpp:61:14:61:16 | buf | test.cpp:61:9:61:19 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:61:9:61:23 | Store: ... = ... | write |
53+
| test.cpp:72:5:72:15 | PointerAdd: access to array | test.cpp:79:32:79:34 | buf | test.cpp:72:5:72:15 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:72:5:72:19 | Store: ... = ... | write |
54+
| test.cpp:77:27:77:44 | PointerAdd: access to array | test.cpp:77:32:77:34 | buf | test.cpp:66:32:66:32 | p | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
55+
| test.cpp:77:27:77:44 | PointerAdd: access to array | test.cpp:77:32:77:34 | buf | test.cpp:66:32:66:32 | p | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
56+
| test.cpp:77:27:77:44 | PointerAdd: access to array | test.cpp:77:32:77:34 | buf | test.cpp:67:5:67:6 | * ... | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
57+
| test.cpp:77:27:77:44 | PointerAdd: access to array | test.cpp:77:32:77:34 | buf | test.cpp:67:6:67:6 | p | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |

0 commit comments

Comments
 (0)