mirror of
https://github.com/github/codeql.git
synced 2026-05-05 05:35:13 +02:00
Merge remote-tracking branch 'upstream/main' into mathiasvp/replace-ast-with-ir-use-usedataflow
This commit is contained in:
Jeroen Ketema
@@ -1,36 +1,32 @@
|
||||
edges
|
||||
| test.c:9:23:9:26 | argv | test.c:17:11:17:18 | Convert indirection |
|
||||
| test.c:9:23:9:26 | argv indirection | test.c:17:11:17:18 | Convert indirection |
|
||||
| test.c:9:23:9:26 | argv indirection | test.c:17:11:17:18 | Convert indirection |
|
||||
| test.c:31:22:31:25 | argv indirection | test.c:32:11:32:18 | Convert indirection |
|
||||
| test.c:31:22:31:25 | argv indirection | test.c:32:11:32:18 | Convert indirection |
|
||||
| test.c:8:27:8:30 | argv | test.c:17:11:17:18 | Convert indirection |
|
||||
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | Convert indirection |
|
||||
| test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | Convert indirection |
|
||||
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | Convert indirection |
|
||||
| test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | Convert indirection |
|
||||
| test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection |
|
||||
| test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection |
|
||||
| test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | Convert indirection |
|
||||
| test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | Convert indirection |
|
||||
| test.c:57:10:57:13 | argv indirection | test.c:57:10:57:16 | access to array indirection |
|
||||
| test.c:57:10:57:13 | argv indirection | test.c:57:10:57:16 | access to array indirection |
|
||||
nodes
|
||||
| test.c:9:23:9:26 | argv | semmle.label | argv |
|
||||
| test.c:9:23:9:26 | argv indirection | semmle.label | argv indirection |
|
||||
| test.c:9:23:9:26 | argv indirection | semmle.label | argv indirection |
|
||||
| test.c:8:27:8:30 | argv | semmle.label | argv |
|
||||
| test.c:8:27:8:30 | argv indirection | semmle.label | argv indirection |
|
||||
| test.c:8:27:8:30 | argv indirection | semmle.label | argv indirection |
|
||||
| test.c:17:11:17:18 | Convert indirection | semmle.label | Convert indirection |
|
||||
| test.c:31:22:31:25 | argv indirection | semmle.label | argv indirection |
|
||||
| test.c:31:22:31:25 | argv indirection | semmle.label | argv indirection |
|
||||
| test.c:32:11:32:18 | Convert indirection | semmle.label | Convert indirection |
|
||||
| test.c:37:17:37:24 | scanf output argument | semmle.label | scanf output argument |
|
||||
| test.c:38:11:38:18 | Convert indirection | semmle.label | Convert indirection |
|
||||
| test.c:43:17:43:24 | scanf output argument | semmle.label | scanf output argument |
|
||||
| test.c:44:11:44:18 | Convert indirection | semmle.label | Convert indirection |
|
||||
| test.c:57:10:57:13 | argv indirection | semmle.label | argv indirection |
|
||||
| test.c:57:10:57:13 | argv indirection | semmle.label | argv indirection |
|
||||
| test.c:57:10:57:16 | access to array indirection | semmle.label | access to array indirection |
|
||||
subpaths
|
||||
#select
|
||||
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv | user input (a command-line argument) |
|
||||
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv indirection | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:17:11:17:18 | fileName | test.c:9:23:9:26 | argv indirection | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:9:23:9:26 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:32:11:32:18 | fileName | test.c:31:22:31:25 | argv indirection | test.c:32:11:32:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:31:22:31:25 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:32:11:32:18 | fileName | test.c:31:22:31:25 | argv indirection | test.c:32:11:32:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:31:22:31:25 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv | user input (a command-line argument) |
|
||||
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:17:11:17:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:17:11:17:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:32:11:32:18 | fileName | test.c:8:27:8:30 | argv indirection | test.c:32:11:32:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:38:11:38:18 | fileName | test.c:37:17:37:24 | scanf output argument | test.c:38:11:38:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:37:17:37:24 | scanf output argument | user input (value read by scanf) |
|
||||
| test.c:44:11:44:18 | fileName | test.c:43:17:43:24 | scanf output argument | test.c:44:11:44:18 | Convert indirection | This argument to a file access function is derived from $@ and then passed to fopen(filename). | test.c:43:17:43:24 | scanf output argument | user input (value read by scanf) |
|
||||
| test.c:57:10:57:16 | access to array | test.c:57:10:57:13 | argv indirection | test.c:57:10:57:16 | access to array indirection | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:57:10:57:13 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:57:10:57:16 | access to array | test.c:57:10:57:13 | argv indirection | test.c:57:10:57:16 | access to array indirection | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:57:10:57:13 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:57:10:57:16 | access to array | test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.c:57:10:57:16 | access to array | test.c:8:27:8:30 | argv indirection | test.c:57:10:57:16 | access to array indirection | This argument to a file access function is derived from $@ and then passed to read(fileName), which calls fopen(filename). | test.c:8:27:8:30 | argv indirection | user input (a command-line argument) |
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
edges
|
||||
| test.cpp:16:20:16:23 | argv indirection | test.cpp:22:45:22:52 | Load indirection |
|
||||
| test.cpp:16:20:16:23 | argv indirection | test.cpp:22:45:22:52 | Load indirection |
|
||||
| test.cpp:15:27:15:30 | argv indirection | test.cpp:22:45:22:52 | Load indirection |
|
||||
| test.cpp:15:27:15:30 | argv indirection | test.cpp:22:45:22:52 | Load indirection |
|
||||
| test.cpp:22:13:22:20 | sprintf output argument | test.cpp:23:12:23:19 | Convert indirection |
|
||||
| test.cpp:22:45:22:52 | Load indirection | test.cpp:22:13:22:20 | sprintf output argument |
|
||||
| test.cpp:47:21:47:26 | call to getenv indirection | test.cpp:50:35:50:43 | Load indirection |
|
||||
@@ -101,8 +101,8 @@ edges
|
||||
| test.cpp:220:19:220:26 | Convert indirection | test.cpp:220:10:220:16 | strncat output argument |
|
||||
| test.cpp:220:19:220:26 | Convert indirection | test.cpp:220:10:220:16 | strncat output argument |
|
||||
nodes
|
||||
| test.cpp:16:20:16:23 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:16:20:16:23 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:15:27:15:30 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:15:27:15:30 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:22:13:22:20 | sprintf output argument | semmle.label | sprintf output argument |
|
||||
| test.cpp:22:45:22:52 | Load indirection | semmle.label | Load indirection |
|
||||
| test.cpp:23:12:23:19 | Convert indirection | semmle.label | Convert indirection |
|
||||
@@ -211,8 +211,8 @@ subpaths
|
||||
| test.cpp:196:26:196:33 | filename | test.cpp:186:47:186:54 | filename | test.cpp:187:11:187:15 | strncat output argument | test.cpp:196:19:196:23 | concat output argument |
|
||||
| test.cpp:196:26:196:33 | filename | test.cpp:186:47:186:54 | filename | test.cpp:188:11:188:17 | strncat output argument | test.cpp:196:10:196:16 | concat output argument |
|
||||
#select
|
||||
| test.cpp:23:12:23:19 | command1 | test.cpp:16:20:16:23 | argv indirection | test.cpp:23:12:23:19 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:16:20:16:23 | argv indirection | user input (a command-line argument) | test.cpp:22:13:22:20 | sprintf output argument | sprintf output argument |
|
||||
| test.cpp:23:12:23:19 | command1 | test.cpp:16:20:16:23 | argv indirection | test.cpp:23:12:23:19 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:16:20:16:23 | argv indirection | user input (a command-line argument) | test.cpp:22:13:22:20 | sprintf output argument | sprintf output argument |
|
||||
| test.cpp:23:12:23:19 | command1 | test.cpp:15:27:15:30 | argv indirection | test.cpp:23:12:23:19 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:15:27:15:30 | argv indirection | user input (a command-line argument) | test.cpp:22:13:22:20 | sprintf output argument | sprintf output argument |
|
||||
| test.cpp:23:12:23:19 | command1 | test.cpp:15:27:15:30 | argv indirection | test.cpp:23:12:23:19 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:15:27:15:30 | argv indirection | user input (a command-line argument) | test.cpp:22:13:22:20 | sprintf output argument | sprintf output argument |
|
||||
| test.cpp:51:10:51:16 | command | test.cpp:47:21:47:26 | call to getenv indirection | test.cpp:51:10:51:16 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:47:21:47:26 | call to getenv indirection | user input (an environment variable) | test.cpp:50:11:50:17 | sprintf output argument | sprintf output argument |
|
||||
| test.cpp:65:10:65:16 | command | test.cpp:62:9:62:16 | fread output argument | test.cpp:65:10:65:16 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:62:9:62:16 | fread output argument | user input (string read by fread) | test.cpp:64:11:64:17 | strncat output argument | strncat output argument |
|
||||
| test.cpp:85:32:85:38 | command | test.cpp:82:9:82:16 | fread output argument | test.cpp:85:32:85:38 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to execl. | test.cpp:82:9:82:16 | fread output argument | user input (string read by fread) | test.cpp:84:11:84:17 | strncat output argument | strncat output argument |
|
||||
|
||||
@@ -50,7 +50,6 @@
|
||||
| tests.cpp:546:6:546:10 | call to fread | This 'fread' operation may access 400 bytes but the $@ is only 100 bytes. | tests.cpp:532:7:532:16 | charBuffer | destination buffer |
|
||||
| tests.cpp:569:6:569:15 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:565:7:565:12 | buffer | array |
|
||||
| tests.cpp:577:7:577:13 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:565:7:565:12 | buffer | array |
|
||||
| tests.cpp:586:6:586:12 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:565:7:565:12 | buffer | array |
|
||||
| tests_restrict.c:12:2:12:7 | call to memcpy | This 'memcpy' operation accesses 2 bytes but the $@ is only 1 byte. | tests_restrict.c:7:6:7:13 | smallbuf | source buffer |
|
||||
| unions.cpp:26:2:26:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:21:10:21:11 | mu | destination buffer |
|
||||
| unions.cpp:27:2:27:7 | call to memset | This 'memset' operation accesses 100 bytes but the $@ is only 10 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |
|
||||
|
||||
@@ -1,7 +1,16 @@
|
||||
edges
|
||||
| overflowdestination.cpp:27:9:27:12 | argv | overflowdestination.cpp:30:17:30:20 | arg1 |
|
||||
| overflowdestination.cpp:27:9:27:12 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 |
|
||||
| overflowdestination.cpp:27:9:27:12 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 |
|
||||
| main.cpp:6:27:6:30 | argv | main.cpp:7:33:7:36 | argv |
|
||||
| main.cpp:6:27:6:30 | argv indirection | main.cpp:7:33:7:36 | Load indirection |
|
||||
| main.cpp:6:27:6:30 | argv indirection | main.cpp:7:33:7:36 | Load indirection |
|
||||
| main.cpp:6:27:6:30 | argv indirection | main.cpp:7:33:7:36 | Load indirection |
|
||||
| main.cpp:6:27:6:30 | argv indirection | main.cpp:7:33:7:36 | argv |
|
||||
| main.cpp:6:27:6:30 | argv indirection | main.cpp:7:33:7:36 | argv |
|
||||
| main.cpp:7:33:7:36 | Load indirection | overflowdestination.cpp:23:45:23:48 | argv indirection |
|
||||
| main.cpp:7:33:7:36 | Load indirection | overflowdestination.cpp:23:45:23:48 | argv indirection |
|
||||
| main.cpp:7:33:7:36 | argv | overflowdestination.cpp:23:45:23:48 | argv |
|
||||
| overflowdestination.cpp:23:45:23:48 | argv | overflowdestination.cpp:30:17:30:20 | arg1 |
|
||||
| overflowdestination.cpp:23:45:23:48 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 |
|
||||
| overflowdestination.cpp:23:45:23:48 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 |
|
||||
| overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | src |
|
||||
| overflowdestination.cpp:50:52:50:54 | src | overflowdestination.cpp:52:9:52:12 | memcpy output argument |
|
||||
| overflowdestination.cpp:50:52:50:54 | src | overflowdestination.cpp:53:9:53:12 | memcpy output argument |
|
||||
@@ -61,9 +70,15 @@ edges
|
||||
| overflowdestination.cpp:76:30:76:32 | src | overflowdestination.cpp:76:24:76:27 | overflowdest_test3 output argument |
|
||||
| overflowdestination.cpp:76:30:76:32 | src | overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument |
|
||||
nodes
|
||||
| overflowdestination.cpp:27:9:27:12 | argv | semmle.label | argv |
|
||||
| overflowdestination.cpp:27:9:27:12 | argv indirection | semmle.label | argv indirection |
|
||||
| overflowdestination.cpp:27:9:27:12 | argv indirection | semmle.label | argv indirection |
|
||||
| main.cpp:6:27:6:30 | argv | semmle.label | argv |
|
||||
| main.cpp:6:27:6:30 | argv indirection | semmle.label | argv indirection |
|
||||
| main.cpp:6:27:6:30 | argv indirection | semmle.label | argv indirection |
|
||||
| main.cpp:7:33:7:36 | Load indirection | semmle.label | Load indirection |
|
||||
| main.cpp:7:33:7:36 | Load indirection | semmle.label | Load indirection |
|
||||
| main.cpp:7:33:7:36 | argv | semmle.label | argv |
|
||||
| overflowdestination.cpp:23:45:23:48 | argv | semmle.label | argv |
|
||||
| overflowdestination.cpp:23:45:23:48 | argv indirection | semmle.label | argv indirection |
|
||||
| overflowdestination.cpp:23:45:23:48 | argv indirection | semmle.label | argv indirection |
|
||||
| overflowdestination.cpp:30:17:30:20 | arg1 | semmle.label | arg1 |
|
||||
| overflowdestination.cpp:43:8:43:10 | fgets output argument | semmle.label | fgets output argument |
|
||||
| overflowdestination.cpp:46:15:46:17 | src | semmle.label | src |
|
||||
@@ -121,9 +136,9 @@ subpaths
|
||||
| overflowdestination.cpp:76:30:76:32 | src | overflowdestination.cpp:57:52:57:54 | src | overflowdestination.cpp:65:9:65:13 | memcpy output argument | overflowdestination.cpp:76:24:76:27 | overflowdest_test3 output argument |
|
||||
| overflowdestination.cpp:76:30:76:32 | src | overflowdestination.cpp:57:52:57:54 | src | overflowdestination.cpp:65:9:65:13 | memcpy output argument | overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument |
|
||||
#select
|
||||
| overflowdestination.cpp:30:2:30:8 | call to strncpy | overflowdestination.cpp:27:9:27:12 | argv | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
| overflowdestination.cpp:30:2:30:8 | call to strncpy | overflowdestination.cpp:27:9:27:12 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
| overflowdestination.cpp:30:2:30:8 | call to strncpy | overflowdestination.cpp:27:9:27:12 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
| overflowdestination.cpp:30:2:30:8 | call to strncpy | main.cpp:6:27:6:30 | argv | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
| overflowdestination.cpp:30:2:30:8 | call to strncpy | main.cpp:6:27:6:30 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
| overflowdestination.cpp:30:2:30:8 | call to strncpy | main.cpp:6:27:6:30 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
| overflowdestination.cpp:46:2:46:7 | call to memcpy | overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | src | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
| overflowdestination.cpp:53:2:53:7 | call to memcpy | overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:53:15:53:17 | src | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
| overflowdestination.cpp:64:2:64:7 | call to memcpy | overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:64:16:64:19 | src2 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
|
||||
|
||||
@@ -0,0 +1,12 @@
|
||||
int overflowdesination_main(int argc, char **argv);
|
||||
int test_buffer_overrun_main(int argc, char **argv);
|
||||
int tests_restrict_main(int argc, char **argv);
|
||||
int tests_main(int argc, char **argv);
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
overflowdesination_main(argc, argv);
|
||||
test_buffer_overrun_main(argc, argv);
|
||||
tests_restrict_main(argc, argv);
|
||||
tests_main(argc, argv);
|
||||
return 0;
|
||||
}
|
||||
@@ -20,7 +20,7 @@ inline size_t min(size_t a, size_t b) {
|
||||
}
|
||||
}
|
||||
|
||||
int main(int argc, char* argv[]) {
|
||||
int overflowdesination_main(int argc, char* argv[]) {
|
||||
char param[20];
|
||||
char *arg1;
|
||||
|
||||
|
||||
@@ -29,7 +29,7 @@ void test_buffer_overrun_in_while_loop_using_array_indexing()
|
||||
}
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
int test_buffer_overrun_main(int argc, char *argv[])
|
||||
{
|
||||
test_buffer_overrun_in_for_loop();
|
||||
test_buffer_overrun_in_while_loop_using_pointer_arithmetic();
|
||||
|
||||
@@ -603,7 +603,7 @@ void test22(bool b, const char* source) {
|
||||
memcpy(dest, source, n); // GOOD
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
int tests_main(int argc, char *argv[])
|
||||
{
|
||||
long long arr17[19];
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@ void test1()
|
||||
memcpy(largebuf, smallbuf, 2); // BAD: source over-read
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
int tests_restrict_main(int argc, char *argv[])
|
||||
{
|
||||
test1();
|
||||
|
||||
|
||||
@@ -1,16 +1,16 @@
|
||||
edges
|
||||
| test1.c:8:16:8:19 | argv | test1.c:9:9:9:9 | i |
|
||||
| test1.c:8:16:8:19 | argv | test1.c:11:9:11:9 | i |
|
||||
| test1.c:8:16:8:19 | argv | test1.c:12:9:12:9 | i |
|
||||
| test1.c:8:16:8:19 | argv | test1.c:13:9:13:9 | i |
|
||||
| test1.c:8:16:8:19 | argv indirection | test1.c:9:9:9:9 | i |
|
||||
| test1.c:8:16:8:19 | argv indirection | test1.c:9:9:9:9 | i |
|
||||
| test1.c:8:16:8:19 | argv indirection | test1.c:11:9:11:9 | i |
|
||||
| test1.c:8:16:8:19 | argv indirection | test1.c:11:9:11:9 | i |
|
||||
| test1.c:8:16:8:19 | argv indirection | test1.c:12:9:12:9 | i |
|
||||
| test1.c:8:16:8:19 | argv indirection | test1.c:12:9:12:9 | i |
|
||||
| test1.c:8:16:8:19 | argv indirection | test1.c:13:9:13:9 | i |
|
||||
| test1.c:8:16:8:19 | argv indirection | test1.c:13:9:13:9 | i |
|
||||
| test1.c:7:26:7:29 | argv | test1.c:9:9:9:9 | i |
|
||||
| test1.c:7:26:7:29 | argv | test1.c:11:9:11:9 | i |
|
||||
| test1.c:7:26:7:29 | argv | test1.c:12:9:12:9 | i |
|
||||
| test1.c:7:26:7:29 | argv | test1.c:13:9:13:9 | i |
|
||||
| test1.c:7:26:7:29 | argv indirection | test1.c:9:9:9:9 | i |
|
||||
| test1.c:7:26:7:29 | argv indirection | test1.c:9:9:9:9 | i |
|
||||
| test1.c:7:26:7:29 | argv indirection | test1.c:11:9:11:9 | i |
|
||||
| test1.c:7:26:7:29 | argv indirection | test1.c:11:9:11:9 | i |
|
||||
| test1.c:7:26:7:29 | argv indirection | test1.c:12:9:12:9 | i |
|
||||
| test1.c:7:26:7:29 | argv indirection | test1.c:12:9:12:9 | i |
|
||||
| test1.c:7:26:7:29 | argv indirection | test1.c:13:9:13:9 | i |
|
||||
| test1.c:7:26:7:29 | argv indirection | test1.c:13:9:13:9 | i |
|
||||
| test1.c:9:9:9:9 | i | test1.c:16:16:16:16 | i |
|
||||
| test1.c:11:9:11:9 | i | test1.c:32:16:32:16 | i |
|
||||
| test1.c:12:9:12:9 | i | test1.c:40:16:40:16 | i |
|
||||
@@ -20,9 +20,9 @@ edges
|
||||
| test1.c:40:16:40:16 | i | test1.c:41:11:41:11 | i |
|
||||
| test1.c:48:16:48:16 | i | test1.c:53:15:53:15 | j |
|
||||
nodes
|
||||
| test1.c:8:16:8:19 | argv | semmle.label | argv |
|
||||
| test1.c:8:16:8:19 | argv indirection | semmle.label | argv indirection |
|
||||
| test1.c:8:16:8:19 | argv indirection | semmle.label | argv indirection |
|
||||
| test1.c:7:26:7:29 | argv | semmle.label | argv |
|
||||
| test1.c:7:26:7:29 | argv indirection | semmle.label | argv indirection |
|
||||
| test1.c:7:26:7:29 | argv indirection | semmle.label | argv indirection |
|
||||
| test1.c:9:9:9:9 | i | semmle.label | i |
|
||||
| test1.c:11:9:11:9 | i | semmle.label | i |
|
||||
| test1.c:12:9:12:9 | i | semmle.label | i |
|
||||
@@ -37,15 +37,15 @@ nodes
|
||||
| test1.c:53:15:53:15 | j | semmle.label | j |
|
||||
subpaths
|
||||
#select
|
||||
| test1.c:18:16:18:16 | i | test1.c:8:16:8:19 | argv | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv | a command-line argument |
|
||||
| test1.c:18:16:18:16 | i | test1.c:8:16:8:19 | argv indirection | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
|
||||
| test1.c:18:16:18:16 | i | test1.c:8:16:8:19 | argv indirection | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
|
||||
| test1.c:33:11:33:11 | i | test1.c:8:16:8:19 | argv | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv | a command-line argument |
|
||||
| test1.c:33:11:33:11 | i | test1.c:8:16:8:19 | argv indirection | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
|
||||
| test1.c:33:11:33:11 | i | test1.c:8:16:8:19 | argv indirection | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
|
||||
| test1.c:41:11:41:11 | i | test1.c:8:16:8:19 | argv | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv | a command-line argument |
|
||||
| test1.c:41:11:41:11 | i | test1.c:8:16:8:19 | argv indirection | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
|
||||
| test1.c:41:11:41:11 | i | test1.c:8:16:8:19 | argv indirection | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
|
||||
| test1.c:53:15:53:15 | j | test1.c:8:16:8:19 | argv | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv | a command-line argument |
|
||||
| test1.c:53:15:53:15 | j | test1.c:8:16:8:19 | argv indirection | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
|
||||
| test1.c:53:15:53:15 | j | test1.c:8:16:8:19 | argv indirection | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
|
||||
| test1.c:18:16:18:16 | i | test1.c:7:26:7:29 | argv | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv | a command-line argument |
|
||||
| test1.c:18:16:18:16 | i | test1.c:7:26:7:29 | argv indirection | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv indirection | a command-line argument |
|
||||
| test1.c:18:16:18:16 | i | test1.c:7:26:7:29 | argv indirection | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv indirection | a command-line argument |
|
||||
| test1.c:33:11:33:11 | i | test1.c:7:26:7:29 | argv | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv | a command-line argument |
|
||||
| test1.c:33:11:33:11 | i | test1.c:7:26:7:29 | argv indirection | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv indirection | a command-line argument |
|
||||
| test1.c:33:11:33:11 | i | test1.c:7:26:7:29 | argv indirection | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv indirection | a command-line argument |
|
||||
| test1.c:41:11:41:11 | i | test1.c:7:26:7:29 | argv | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv | a command-line argument |
|
||||
| test1.c:41:11:41:11 | i | test1.c:7:26:7:29 | argv indirection | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv indirection | a command-line argument |
|
||||
| test1.c:41:11:41:11 | i | test1.c:7:26:7:29 | argv indirection | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv indirection | a command-line argument |
|
||||
| test1.c:53:15:53:15 | j | test1.c:7:26:7:29 | argv | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv | a command-line argument |
|
||||
| test1.c:53:15:53:15 | j | test1.c:7:26:7:29 | argv indirection | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv indirection | a command-line argument |
|
||||
| test1.c:53:15:53:15 | j | test1.c:7:26:7:29 | argv indirection | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:7:26:7:29 | argv indirection | a command-line argument |
|
||||
|
||||
@@ -1,22 +1,22 @@
|
||||
edges
|
||||
| test.cpp:40:21:40:24 | argv | test.cpp:43:38:43:44 | tainted |
|
||||
| test.cpp:40:21:40:24 | argv | test.cpp:44:38:44:63 | ... * ... |
|
||||
| test.cpp:40:21:40:24 | argv | test.cpp:46:38:46:63 | ... + ... |
|
||||
| test.cpp:40:21:40:24 | argv | test.cpp:49:32:49:35 | size |
|
||||
| test.cpp:40:21:40:24 | argv | test.cpp:50:26:50:29 | size |
|
||||
| test.cpp:40:21:40:24 | argv | test.cpp:53:35:53:60 | ... * ... |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:43:38:43:44 | tainted |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:43:38:43:44 | tainted |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:44:38:44:63 | ... * ... |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:44:38:44:63 | ... * ... |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:46:38:46:63 | ... + ... |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:46:38:46:63 | ... + ... |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:49:32:49:35 | size |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:49:32:49:35 | size |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:50:26:50:29 | size |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:50:26:50:29 | size |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:53:35:53:60 | ... * ... |
|
||||
| test.cpp:40:21:40:24 | argv indirection | test.cpp:53:35:53:60 | ... * ... |
|
||||
| test.cpp:39:27:39:30 | argv | test.cpp:43:38:43:44 | tainted |
|
||||
| test.cpp:39:27:39:30 | argv | test.cpp:44:38:44:63 | ... * ... |
|
||||
| test.cpp:39:27:39:30 | argv | test.cpp:46:38:46:63 | ... + ... |
|
||||
| test.cpp:39:27:39:30 | argv | test.cpp:49:32:49:35 | size |
|
||||
| test.cpp:39:27:39:30 | argv | test.cpp:50:26:50:29 | size |
|
||||
| test.cpp:39:27:39:30 | argv | test.cpp:53:35:53:60 | ... * ... |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:43:38:43:44 | tainted |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:43:38:43:44 | tainted |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:44:38:44:63 | ... * ... |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:44:38:44:63 | ... * ... |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:46:38:46:63 | ... + ... |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:46:38:46:63 | ... + ... |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:49:32:49:35 | size |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:49:32:49:35 | size |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:50:26:50:29 | size |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:50:26:50:29 | size |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:53:35:53:60 | ... * ... |
|
||||
| test.cpp:39:27:39:30 | argv indirection | test.cpp:53:35:53:60 | ... * ... |
|
||||
| test.cpp:124:18:124:23 | call to getenv | test.cpp:128:24:128:41 | ... * ... |
|
||||
| test.cpp:124:18:124:31 | call to getenv indirection | test.cpp:128:24:128:41 | ... * ... |
|
||||
| test.cpp:133:19:133:24 | call to getenv | test.cpp:135:10:135:27 | ... * ... |
|
||||
@@ -47,9 +47,9 @@ edges
|
||||
| test.cpp:338:19:338:24 | call to getenv | test.cpp:342:25:342:43 | ... * ... |
|
||||
| test.cpp:338:19:338:32 | call to getenv indirection | test.cpp:342:25:342:43 | ... * ... |
|
||||
nodes
|
||||
| test.cpp:40:21:40:24 | argv | semmle.label | argv |
|
||||
| test.cpp:40:21:40:24 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:40:21:40:24 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:39:27:39:30 | argv | semmle.label | argv |
|
||||
| test.cpp:39:27:39:30 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:39:27:39:30 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:43:38:43:44 | tainted | semmle.label | tainted |
|
||||
| test.cpp:44:38:44:63 | ... * ... | semmle.label | ... * ... |
|
||||
| test.cpp:46:38:46:63 | ... + ... | semmle.label | ... + ... |
|
||||
@@ -93,24 +93,24 @@ nodes
|
||||
| test.cpp:342:25:342:43 | ... * ... | semmle.label | ... * ... |
|
||||
subpaths
|
||||
#select
|
||||
| test.cpp:43:31:43:36 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
|
||||
| test.cpp:43:31:43:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:43:31:43:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:44:31:44:36 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
|
||||
| test.cpp:44:31:44:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:44:31:44:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:46:31:46:36 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
|
||||
| test.cpp:46:31:46:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:46:31:46:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:49:25:49:30 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
|
||||
| test.cpp:49:25:49:30 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:49:25:49:30 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:50:17:50:30 | new[] | test.cpp:40:21:40:24 | argv | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
|
||||
| test.cpp:50:17:50:30 | new[] | test.cpp:40:21:40:24 | argv indirection | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:50:17:50:30 | new[] | test.cpp:40:21:40:24 | argv indirection | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:53:21:53:27 | call to realloc | test.cpp:40:21:40:24 | argv | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
|
||||
| test.cpp:53:21:53:27 | call to realloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:53:21:53:27 | call to realloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:43:31:43:36 | call to malloc | test.cpp:39:27:39:30 | argv | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv | user input (a command-line argument) |
|
||||
| test.cpp:43:31:43:36 | call to malloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:43:31:43:36 | call to malloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:44:31:44:36 | call to malloc | test.cpp:39:27:39:30 | argv | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv | user input (a command-line argument) |
|
||||
| test.cpp:44:31:44:36 | call to malloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:44:31:44:36 | call to malloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:46:31:46:36 | call to malloc | test.cpp:39:27:39:30 | argv | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv | user input (a command-line argument) |
|
||||
| test.cpp:46:31:46:36 | call to malloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:46:31:46:36 | call to malloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:49:25:49:30 | call to malloc | test.cpp:39:27:39:30 | argv | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv | user input (a command-line argument) |
|
||||
| test.cpp:49:25:49:30 | call to malloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:49:25:49:30 | call to malloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:50:17:50:30 | new[] | test.cpp:39:27:39:30 | argv | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv | user input (a command-line argument) |
|
||||
| test.cpp:50:17:50:30 | new[] | test.cpp:39:27:39:30 | argv indirection | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:50:17:50:30 | new[] | test.cpp:39:27:39:30 | argv indirection | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:53:21:53:27 | call to realloc | test.cpp:39:27:39:30 | argv | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv | user input (a command-line argument) |
|
||||
| test.cpp:53:21:53:27 | call to realloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:53:21:53:27 | call to realloc | test.cpp:39:27:39:30 | argv indirection | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:39:27:39:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:128:17:128:22 | call to malloc | test.cpp:124:18:124:23 | call to getenv | test.cpp:128:24:128:41 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:124:18:124:23 | call to getenv | user input (an environment variable) |
|
||||
| test.cpp:128:17:128:22 | call to malloc | test.cpp:124:18:124:31 | call to getenv indirection | test.cpp:128:24:128:41 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:124:18:124:31 | call to getenv indirection | user input (an environment variable) |
|
||||
| test.cpp:135:3:135:8 | call to malloc | test.cpp:133:19:133:24 | call to getenv | test.cpp:135:10:135:27 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:133:19:133:24 | call to getenv | user input (an environment variable) |
|
||||
|
||||
@@ -1,19 +1,19 @@
|
||||
edges
|
||||
| test2.cpp:110:8:110:15 | gets output argument | test2.cpp:110:3:110:6 | call to gets |
|
||||
| test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input |
|
||||
| test.cpp:54:17:54:20 | argv indirection | test.cpp:58:25:58:29 | input |
|
||||
| test.cpp:54:17:54:20 | argv indirection | test.cpp:58:25:58:29 | input |
|
||||
| test.cpp:53:27:53:30 | argv | test.cpp:58:25:58:29 | input |
|
||||
| test.cpp:53:27:53:30 | argv indirection | test.cpp:58:25:58:29 | input |
|
||||
| test.cpp:53:27:53:30 | argv indirection | test.cpp:58:25:58:29 | input |
|
||||
nodes
|
||||
| test2.cpp:110:3:110:6 | call to gets | semmle.label | call to gets |
|
||||
| test2.cpp:110:8:110:15 | gets output argument | semmle.label | gets output argument |
|
||||
| test.cpp:54:17:54:20 | argv | semmle.label | argv |
|
||||
| test.cpp:54:17:54:20 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:54:17:54:20 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:53:27:53:30 | argv | semmle.label | argv |
|
||||
| test.cpp:53:27:53:30 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:53:27:53:30 | argv indirection | semmle.label | argv indirection |
|
||||
| test.cpp:58:25:58:29 | input | semmle.label | input |
|
||||
subpaths
|
||||
#select
|
||||
| test2.cpp:110:3:110:6 | call to gets | test2.cpp:110:3:110:6 | call to gets | test2.cpp:110:3:110:6 | call to gets | This write into buffer 'password' may contain unencrypted data from $@. | test2.cpp:110:3:110:6 | call to gets | user input (string read by gets) |
|
||||
| test2.cpp:110:3:110:6 | call to gets | test2.cpp:110:8:110:15 | gets output argument | test2.cpp:110:3:110:6 | call to gets | This write into buffer 'password' may contain unencrypted data from $@. | test2.cpp:110:8:110:15 | gets output argument | user input (string read by gets) |
|
||||
| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@. | test.cpp:54:17:54:20 | argv | user input (a command-line argument) |
|
||||
| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv indirection | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@. | test.cpp:54:17:54:20 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:58:3:58:9 | call to sprintf | test.cpp:54:17:54:20 | argv indirection | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@. | test.cpp:54:17:54:20 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:58:3:58:9 | call to sprintf | test.cpp:53:27:53:30 | argv | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@. | test.cpp:53:27:53:30 | argv | user input (a command-line argument) |
|
||||
| test.cpp:58:3:58:9 | call to sprintf | test.cpp:53:27:53:30 | argv indirection | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@. | test.cpp:53:27:53:30 | argv indirection | user input (a command-line argument) |
|
||||
| test.cpp:58:3:58:9 | call to sprintf | test.cpp:53:27:53:30 | argv indirection | test.cpp:58:25:58:29 | input | This write into buffer 'passwd' may contain unencrypted data from $@. | test.cpp:53:27:53:30 | argv indirection | user input (a command-line argument) |
|
||||
|
||||
Reference in New Issue
Block a user