Skip to content

Commit fba753c

Browse files
MathiasVPMathiasVP
committed
C++: Add more test cases to 'cpp/invalid-pointer-deref'.
1 parent ca71d48 commit fba753c

File tree

2 files changed

+184
-0
lines changed

2 files changed

+184
-0
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -788,6 +788,29 @@ edges
788788
| test.cpp:427:14:427:27 | new[] | test.cpp:433:5:433:6 | xs |
789789
| test.cpp:433:5:433:6 | xs | test.cpp:433:5:433:17 | access to array |
790790
| test.cpp:433:5:433:17 | access to array | test.cpp:433:5:433:21 | Store: ... = ... |
791+
| test.cpp:439:14:439:27 | new[] | test.cpp:444:5:444:6 | xs |
792+
| test.cpp:444:5:444:6 | xs | test.cpp:444:5:444:15 | access to array |
793+
| test.cpp:444:5:444:15 | access to array | test.cpp:444:5:444:19 | Store: ... = ... |
794+
| test.cpp:450:14:450:27 | new[] | test.cpp:455:5:455:6 | xs |
795+
| test.cpp:455:5:455:6 | xs | test.cpp:455:5:455:15 | access to array |
796+
| test.cpp:455:5:455:15 | access to array | test.cpp:455:5:455:19 | Store: ... = ... |
797+
| test.cpp:461:14:461:27 | new[] | test.cpp:466:5:466:6 | xs |
798+
| test.cpp:466:5:466:6 | xs | test.cpp:466:5:466:15 | access to array |
799+
| test.cpp:466:5:466:15 | access to array | test.cpp:466:5:466:19 | Store: ... = ... |
800+
| test.cpp:472:14:472:27 | new[] | test.cpp:477:5:477:6 | xs |
801+
| test.cpp:477:5:477:6 | xs | test.cpp:477:5:477:15 | access to array |
802+
| test.cpp:477:5:477:15 | access to array | test.cpp:477:5:477:19 | Store: ... = ... |
803+
| test.cpp:483:14:483:27 | new[] | test.cpp:488:5:488:6 | xs |
804+
| test.cpp:488:5:488:6 | xs | test.cpp:488:5:488:15 | access to array |
805+
| test.cpp:488:5:488:15 | access to array | test.cpp:488:5:488:19 | Store: ... = ... |
806+
| test.cpp:494:14:494:31 | new[] | test.cpp:499:5:499:6 | xs |
807+
| test.cpp:505:14:505:31 | new[] | test.cpp:510:5:510:6 | xs |
808+
| test.cpp:516:14:516:31 | new[] | test.cpp:521:5:521:6 | xs |
809+
| test.cpp:527:14:527:31 | new[] | test.cpp:532:5:532:6 | xs |
810+
| test.cpp:538:14:538:31 | new[] | test.cpp:543:5:543:6 | xs |
811+
| test.cpp:549:14:549:31 | new[] | test.cpp:554:5:554:6 | xs |
812+
| test.cpp:554:5:554:6 | xs | test.cpp:554:5:554:15 | access to array |
813+
| test.cpp:554:5:554:15 | access to array | test.cpp:554:5:554:19 | Store: ... = ... |
791814
nodes
792815
| test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
793816
| test.cpp:5:15:5:15 | p | semmle.label | p |
@@ -1157,6 +1180,40 @@ nodes
11571180
| test.cpp:433:5:433:6 | xs | semmle.label | xs |
11581181
| test.cpp:433:5:433:17 | access to array | semmle.label | access to array |
11591182
| test.cpp:433:5:433:21 | Store: ... = ... | semmle.label | Store: ... = ... |
1183+
| test.cpp:439:14:439:27 | new[] | semmle.label | new[] |
1184+
| test.cpp:444:5:444:6 | xs | semmle.label | xs |
1185+
| test.cpp:444:5:444:15 | access to array | semmle.label | access to array |
1186+
| test.cpp:444:5:444:19 | Store: ... = ... | semmle.label | Store: ... = ... |
1187+
| test.cpp:450:14:450:27 | new[] | semmle.label | new[] |
1188+
| test.cpp:455:5:455:6 | xs | semmle.label | xs |
1189+
| test.cpp:455:5:455:15 | access to array | semmle.label | access to array |
1190+
| test.cpp:455:5:455:19 | Store: ... = ... | semmle.label | Store: ... = ... |
1191+
| test.cpp:461:14:461:27 | new[] | semmle.label | new[] |
1192+
| test.cpp:466:5:466:6 | xs | semmle.label | xs |
1193+
| test.cpp:466:5:466:15 | access to array | semmle.label | access to array |
1194+
| test.cpp:466:5:466:19 | Store: ... = ... | semmle.label | Store: ... = ... |
1195+
| test.cpp:472:14:472:27 | new[] | semmle.label | new[] |
1196+
| test.cpp:477:5:477:6 | xs | semmle.label | xs |
1197+
| test.cpp:477:5:477:15 | access to array | semmle.label | access to array |
1198+
| test.cpp:477:5:477:19 | Store: ... = ... | semmle.label | Store: ... = ... |
1199+
| test.cpp:483:14:483:27 | new[] | semmle.label | new[] |
1200+
| test.cpp:488:5:488:6 | xs | semmle.label | xs |
1201+
| test.cpp:488:5:488:15 | access to array | semmle.label | access to array |
1202+
| test.cpp:488:5:488:19 | Store: ... = ... | semmle.label | Store: ... = ... |
1203+
| test.cpp:494:14:494:31 | new[] | semmle.label | new[] |
1204+
| test.cpp:499:5:499:6 | xs | semmle.label | xs |
1205+
| test.cpp:505:14:505:31 | new[] | semmle.label | new[] |
1206+
| test.cpp:510:5:510:6 | xs | semmle.label | xs |
1207+
| test.cpp:516:14:516:31 | new[] | semmle.label | new[] |
1208+
| test.cpp:521:5:521:6 | xs | semmle.label | xs |
1209+
| test.cpp:527:14:527:31 | new[] | semmle.label | new[] |
1210+
| test.cpp:532:5:532:6 | xs | semmle.label | xs |
1211+
| test.cpp:538:14:538:31 | new[] | semmle.label | new[] |
1212+
| test.cpp:543:5:543:6 | xs | semmle.label | xs |
1213+
| test.cpp:549:14:549:31 | new[] | semmle.label | new[] |
1214+
| test.cpp:554:5:554:6 | xs | semmle.label | xs |
1215+
| test.cpp:554:5:554:15 | access to array | semmle.label | access to array |
1216+
| test.cpp:554:5:554:19 | Store: ... = ... | semmle.label | Store: ... = ... |
11601217
subpaths
11611218
#select
11621219
| test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -1187,3 +1244,9 @@ subpaths
11871244
| test.cpp:407:3:407:22 | Store: ... = ... | test.cpp:404:12:404:25 | new[] | test.cpp:407:3:407:22 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:404:12:404:25 | new[] | new[] | test.cpp:407:10:407:17 | ... - ... | ... - ... |
11881245
| test.cpp:419:7:419:15 | Store: ... = ... | test.cpp:417:16:417:33 | new[] | test.cpp:419:7:419:15 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:417:16:417:33 | new[] | new[] | test.cpp:419:10:419:10 | i | i |
11891246
| test.cpp:433:5:433:21 | Store: ... = ... | test.cpp:427:14:427:27 | new[] | test.cpp:433:5:433:21 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:427:14:427:27 | new[] | new[] | test.cpp:433:8:433:16 | ... ++ | ... ++ |
1247+
| test.cpp:444:5:444:19 | Store: ... = ... | test.cpp:439:14:439:27 | new[] | test.cpp:444:5:444:19 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:439:14:439:27 | new[] | new[] | test.cpp:444:8:444:14 | src_pos | src_pos |
1248+
| test.cpp:455:5:455:19 | Store: ... = ... | test.cpp:450:14:450:27 | new[] | test.cpp:455:5:455:19 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:450:14:450:27 | new[] | new[] | test.cpp:455:8:455:14 | src_pos | src_pos |
1249+
| test.cpp:466:5:466:19 | Store: ... = ... | test.cpp:461:14:461:27 | new[] | test.cpp:466:5:466:19 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:461:14:461:27 | new[] | new[] | test.cpp:466:8:466:14 | src_pos | src_pos |
1250+
| test.cpp:477:5:477:19 | Store: ... = ... | test.cpp:472:14:472:27 | new[] | test.cpp:477:5:477:19 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:472:14:472:27 | new[] | new[] | test.cpp:477:8:477:14 | src_pos | src_pos |
1251+
| test.cpp:488:5:488:19 | Store: ... = ... | test.cpp:483:14:483:27 | new[] | test.cpp:488:5:488:19 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:483:14:483:27 | new[] | new[] | test.cpp:488:8:488:14 | src_pos | src_pos |
1252+
| test.cpp:554:5:554:19 | Store: ... = ... | test.cpp:549:14:549:31 | new[] | test.cpp:554:5:554:19 | Store: ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:549:14:549:31 | new[] | new[] | test.cpp:554:8:554:14 | src_pos | src_pos |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -433,3 +433,124 @@ void test31(unsigned size, unsigned src_pos)
433433
xs[dst_pos++] = 0; // GOOD [FALSE POSITIVE]
434434
}
435435
}
436+
437+
void test31_simple1(unsigned size, unsigned src_pos)
438+
{
439+
char *xs = new char[size];
440+
if (src_pos > size) {
441+
src_pos = size;
442+
}
443+
if(src_pos < size) {
444+
xs[src_pos] = 0; // GOOD [FALSE POSITIVE]
445+
}
446+
}
447+
448+
void test31_simple2(unsigned size, unsigned src_pos)
449+
{
450+
char *xs = new char[size];
451+
if (src_pos > size) {
452+
src_pos = size;
453+
}
454+
if(src_pos < size + 1) {
455+
xs[src_pos] = 0; // BAD
456+
}
457+
}
458+
459+
void test31_simple3(unsigned size, unsigned src_pos)
460+
{
461+
char *xs = new char[size];
462+
if (src_pos > size) {
463+
src_pos = size;
464+
}
465+
if(src_pos - 1 < size) {
466+
xs[src_pos] = 0; // BAD
467+
}
468+
}
469+
470+
void test31_simple4(unsigned size, unsigned src_pos)
471+
{
472+
char *xs = new char[size];
473+
if (src_pos > size) {
474+
src_pos = size;
475+
}
476+
if(src_pos < size - 1) {
477+
xs[src_pos] = 0; // GOOD [FALSE POSITIVE]
478+
}
479+
}
480+
481+
void test31_simple5(unsigned size, unsigned src_pos)
482+
{
483+
char *xs = new char[size];
484+
if (src_pos > size) {
485+
src_pos = size;
486+
}
487+
if(src_pos + 1 < size) {
488+
xs[src_pos] = 0; // GOOD [FALSE POSITIVE]
489+
}
490+
}
491+
492+
void test31_simple1_plus1(unsigned size, unsigned src_pos)
493+
{
494+
char *xs = new char[size + 1];
495+
if (src_pos > size) {
496+
src_pos = size;
497+
}
498+
if(src_pos < size) {
499+
xs[src_pos] = 0; // GOOD
500+
}
501+
}
502+
503+
void test31_simple2_plus1(unsigned size, unsigned src_pos)
504+
{
505+
char *xs = new char[size + 1];
506+
if (src_pos > size) {
507+
src_pos = size;
508+
}
509+
if(src_pos < size + 1) {
510+
xs[src_pos] = 0; // GOOD
511+
}
512+
}
513+
514+
void test31_simple3_plus1(unsigned size, unsigned src_pos)
515+
{
516+
char *xs = new char[size + 1];
517+
if (src_pos > size) {
518+
src_pos = size;
519+
}
520+
if(src_pos - 1 < size) {
521+
xs[src_pos] = 0; // GOOD
522+
}
523+
}
524+
525+
void test31_simple4_plus1(unsigned size, unsigned src_pos)
526+
{
527+
char *xs = new char[size + 1];
528+
if (src_pos > size) {
529+
src_pos = size;
530+
}
531+
if(src_pos < size - 1) {
532+
xs[src_pos] = 0; // GOOD
533+
}
534+
}
535+
536+
void test31_simple5_plus1(unsigned size, unsigned src_pos)
537+
{
538+
char *xs = new char[size + 1];
539+
if (src_pos > size) {
540+
src_pos = size;
541+
}
542+
if(src_pos + 1 < size) {
543+
xs[src_pos] = 0; // GOOD
544+
}
545+
}
546+
547+
void test31_simple1_sub1(unsigned size, unsigned src_pos)
548+
{
549+
char *xs = new char[size - 1];
550+
if (src_pos > size) {
551+
src_pos = size;
552+
}
553+
if(src_pos < size) {
554+
xs[src_pos] = 0; // BAD
555+
}
556+
}

0 commit comments

Comments
 (0)