hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 04:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into model-gets

Browse Source
This commit is contained in:
Geoffrey White
2020-03-16 15:12:36 +00:00
parent c641a31640 17c57dcb4c
commit 034f7cc948
655 changed files with 27519 additions and 12186 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.c
View File

@@ -146,19 +146,21 @@ int main(int argc, char **argv) {
// BAD: i8 value comes from argv
char *i8;
*(&i8 + 1) = argv[1];
*(&i8) = argv[1];
printf(i8);
printWrapper(i8);
// BAD: i9 value comes from argv
char *i9;
memcpy(1 ? i9++ : 0, argv[1], 1);
char i9buf[32];
char *i9 = i9buf;
memcpy(1 ? ++i9 : 0, argv[1], 1);
printf(i9);
printWrapper(i9);
// BAD: i91 value comes from argv
char *i91;
memcpy(0 ? 0 : (char *)((int) i91 * 2), argv[1], 1);
char i91buf[64];
char *i91 = &i91buf[0];
memcpy(0 ? 0 : i91, argv[1] + 1, 1);
printf(i91);
printWrapper(i91);

10
cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected
View File

@@ -18,5 +18,11 @@
| argvLocal.c:136:15:136:18 | -- ... | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:115:13:115:16 | argv | argv |
| argvLocal.c:144:9:144:10 | i7 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:100:7:100:10 | argv | argv |
| argvLocal.c:145:15:145:16 | i7 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:100:7:100:10 | argv | argv |
| argvLocal.c:167:18:167:20 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:166:18:166:21 | argv | argv |
| argvLocal.c:168:24:168:26 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:166:18:166:21 | argv | argv |
| argvLocal.c:150:9:150:10 | i8 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:149:11:149:14 | argv | argv |
| argvLocal.c:151:15:151:16 | i8 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:149:11:149:14 | argv | argv |
| argvLocal.c:157:9:157:10 | i9 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:156:23:156:26 | argv | argv |
| argvLocal.c:158:15:158:16 | i9 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:156:23:156:26 | argv | argv |
| argvLocal.c:164:9:164:11 | i91 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:163:22:163:25 | argv | argv |
| argvLocal.c:165:15:165:17 | i91 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:163:22:163:25 | argv | argv |
| argvLocal.c:169:18:169:20 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:168:18:168:21 | argv | argv |
| argvLocal.c:170:24:170:26 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:168:18:168:21 | argv | argv |

1
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
View File

@@ -6,3 +6,4 @@
| test.cpp:49:17:49:30 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
| test.cpp:52:21:52:27 | call to realloc | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
| test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
| test.cpp:127:17:127:22 | call to malloc | This allocation size is derived from $@ and might overflow | test.cpp:123:25:123:30 | call to getenv | user input (getenv) |

21
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
View File

@@ -105,3 +105,24 @@ void processFile()
fclose(f);
}
}
char *getenv(const char *name);
#define MAX_SIZE 500
int bounded(int x, int limit) {
int result = x;
if (x <= 0)
result = 1;
else if (x > limit)
result = limit;
return result;
}
void open_file_bounded () {
int size = size = atoi(getenv("USER"));
int bounded_size = bounded(size, MAX_SIZE);
int* a = (int*)malloc(bounded_size); // GOOD
int* b = (int*)malloc(size); // BAD
}

7
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/wider_type/test.c
View File

@@ -69,3 +69,10 @@ void test10(int x) {
} while (0);
}
}
extern const int const256;
void test11() {
short s;
for(s = 0; s < const256; ++s) {}
}

1
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/wider_type/test2.c Normal file
View File

@@ -0,0 +1 @@
const int const256 = 256;