hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Pick the offset expression as the sink in 'cpp/unclear-array-index-validation' (and not the array expression).

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2022-03-10 10:57:51 +00:00
parent 693eca2179
commit 0d3e47bcae
1 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
cpp/ql/src/Security/CWE/CWE-129/ImproperArrayIndexValidation.ql
View File

@@ -35,11 +35,6 @@ predicate linearBoundControls(BasicBlock controlled, SsaDefinition def, StackVar
)
}
predicate isUnboundedArrayIndex(DataFlow::Node sink, VariableAccess offsetExpr) {
offsetExpr = sink.asExpr().(ArrayExpr).getArrayOffset() and
not hasUpperBound(offsetExpr)
}
predicate readsVariable(LoadInstruction load, Variable var) {
load.getSourceAddress().(VariableAddressInstruction).getASTVariable() = var
}
@@ -79,16 +74,21 @@ class ImproperArrayIndexValidationConfig extends TaintTracking::Configuration {
)
}
override predicate isSink(DataFlow::Node sink) { isUnboundedArrayIndex(sink, _) }
override predicate isSink(DataFlow::Node sink) {
exists(ArrayExpr arrayExpr, VariableAccess offsetExpr |
offsetExpr = arrayExpr.getArrayOffset() and
sink.asExpr() = offsetExpr and
not hasUpperBound(offsetExpr)
)
}
}
from
VariableAccess offsetExpr, ImproperArrayIndexValidationConfig conf, DataFlow::PathNode source,
DataFlow::PathNode sink, string sourceType
ImproperArrayIndexValidationConfig conf, DataFlow::PathNode source, DataFlow::PathNode sink,
string sourceType
where
conf.hasFlowPath(source, sink) and
isFlowSource(source.getNode(), sourceType) and
isUnboundedArrayIndex(sink.getNode(), offsetExpr)
isFlowSource(source.getNode(), sourceType)
select sink.getNode(), source, sink,
"$@ flows to here and is used in an array indexing expression, potentially causing an invalid access.",
source.getNode(), sourceType