mirror of
https://github.com/github/codeql.git
synced 2026-05-05 21:55:19 +02:00
C++: Promote 'cpp/overrun-write' out of experimental.
This commit is contained in:
Mathias Vorreiter Pedersen
@@ -0,0 +1,190 @@
|
||||
edges
|
||||
| test.cpp:16:11:16:21 | mk_string_t indirection [string] | test.cpp:39:21:39:31 | call to mk_string_t indirection [string] |
|
||||
| test.cpp:18:5:18:30 | ... = ... | test.cpp:18:10:18:15 | str indirection [post update] [string] |
|
||||
| test.cpp:18:10:18:15 | str indirection [post update] [string] | test.cpp:16:11:16:21 | mk_string_t indirection [string] |
|
||||
| test.cpp:18:19:18:24 | call to malloc | test.cpp:18:5:18:30 | ... = ... |
|
||||
| test.cpp:39:21:39:31 | call to mk_string_t indirection [string] | test.cpp:42:13:42:15 | str indirection [string] |
|
||||
| test.cpp:39:21:39:31 | call to mk_string_t indirection [string] | test.cpp:72:17:72:19 | str indirection [string] |
|
||||
| test.cpp:39:21:39:31 | call to mk_string_t indirection [string] | test.cpp:80:17:80:19 | str indirection [string] |
|
||||
| test.cpp:42:13:42:15 | str indirection [string] | test.cpp:42:18:42:23 | string |
|
||||
| test.cpp:42:13:42:15 | str indirection [string] | test.cpp:42:18:42:23 | string indirection |
|
||||
| test.cpp:42:18:42:23 | string indirection | test.cpp:42:18:42:23 | string |
|
||||
| test.cpp:72:17:72:19 | str indirection [string] | test.cpp:72:22:72:27 | string |
|
||||
| test.cpp:72:17:72:19 | str indirection [string] | test.cpp:72:22:72:27 | string indirection |
|
||||
| test.cpp:72:22:72:27 | string indirection | test.cpp:72:22:72:27 | string |
|
||||
| test.cpp:80:17:80:19 | str indirection [string] | test.cpp:80:22:80:27 | string |
|
||||
| test.cpp:80:17:80:19 | str indirection [string] | test.cpp:80:22:80:27 | string indirection |
|
||||
| test.cpp:80:22:80:27 | string indirection | test.cpp:80:22:80:27 | string |
|
||||
| test.cpp:88:11:88:30 | mk_string_t_plus_one indirection [string] | test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] |
|
||||
| test.cpp:90:5:90:34 | ... = ... | test.cpp:90:10:90:15 | str indirection [post update] [string] |
|
||||
| test.cpp:90:10:90:15 | str indirection [post update] [string] | test.cpp:88:11:88:30 | mk_string_t_plus_one indirection [string] |
|
||||
| test.cpp:90:19:90:24 | call to malloc | test.cpp:90:5:90:34 | ... = ... |
|
||||
| test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] | test.cpp:99:13:99:15 | str indirection [string] |
|
||||
| test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] | test.cpp:129:17:129:19 | str indirection [string] |
|
||||
| test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] | test.cpp:137:17:137:19 | str indirection [string] |
|
||||
| test.cpp:99:13:99:15 | str indirection [string] | test.cpp:99:18:99:23 | string |
|
||||
| test.cpp:99:13:99:15 | str indirection [string] | test.cpp:99:18:99:23 | string indirection |
|
||||
| test.cpp:99:18:99:23 | string indirection | test.cpp:99:18:99:23 | string |
|
||||
| test.cpp:129:17:129:19 | str indirection [string] | test.cpp:129:22:129:27 | string |
|
||||
| test.cpp:129:17:129:19 | str indirection [string] | test.cpp:129:22:129:27 | string indirection |
|
||||
| test.cpp:129:22:129:27 | string indirection | test.cpp:129:22:129:27 | string |
|
||||
| test.cpp:137:17:137:19 | str indirection [string] | test.cpp:137:22:137:27 | string |
|
||||
| test.cpp:137:17:137:19 | str indirection [string] | test.cpp:137:22:137:27 | string indirection |
|
||||
| test.cpp:137:22:137:27 | string indirection | test.cpp:137:22:137:27 | string |
|
||||
| test.cpp:147:5:147:34 | ... = ... | test.cpp:147:10:147:15 | str indirection [post update] [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:152:13:152:15 | str indirection [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:154:13:154:15 | str indirection [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:156:13:156:15 | str indirection [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:175:17:175:19 | str indirection [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:187:17:187:19 | str indirection [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:195:17:195:19 | str indirection [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:199:17:199:19 | str indirection [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:203:17:203:19 | str indirection [string] |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | test.cpp:207:17:207:19 | str indirection [string] |
|
||||
| test.cpp:147:19:147:24 | call to malloc | test.cpp:147:5:147:34 | ... = ... |
|
||||
| test.cpp:152:13:152:15 | str indirection [string] | test.cpp:152:18:152:23 | string |
|
||||
| test.cpp:152:13:152:15 | str indirection [string] | test.cpp:152:18:152:23 | string indirection |
|
||||
| test.cpp:152:18:152:23 | string indirection | test.cpp:152:18:152:23 | string |
|
||||
| test.cpp:154:13:154:15 | str indirection [string] | test.cpp:154:18:154:23 | string |
|
||||
| test.cpp:154:13:154:15 | str indirection [string] | test.cpp:154:18:154:23 | string indirection |
|
||||
| test.cpp:154:18:154:23 | string indirection | test.cpp:154:18:154:23 | string |
|
||||
| test.cpp:156:13:156:15 | str indirection [string] | test.cpp:156:18:156:23 | string |
|
||||
| test.cpp:156:13:156:15 | str indirection [string] | test.cpp:156:18:156:23 | string indirection |
|
||||
| test.cpp:156:18:156:23 | string indirection | test.cpp:156:18:156:23 | string |
|
||||
| test.cpp:175:17:175:19 | str indirection [string] | test.cpp:175:22:175:27 | string |
|
||||
| test.cpp:175:17:175:19 | str indirection [string] | test.cpp:175:22:175:27 | string indirection |
|
||||
| test.cpp:175:22:175:27 | string indirection | test.cpp:175:22:175:27 | string |
|
||||
| test.cpp:187:17:187:19 | str indirection [string] | test.cpp:187:22:187:27 | string |
|
||||
| test.cpp:187:17:187:19 | str indirection [string] | test.cpp:187:22:187:27 | string indirection |
|
||||
| test.cpp:187:22:187:27 | string indirection | test.cpp:187:22:187:27 | string |
|
||||
| test.cpp:195:17:195:19 | str indirection [string] | test.cpp:195:22:195:27 | string |
|
||||
| test.cpp:195:17:195:19 | str indirection [string] | test.cpp:195:22:195:27 | string indirection |
|
||||
| test.cpp:195:22:195:27 | string indirection | test.cpp:195:22:195:27 | string |
|
||||
| test.cpp:199:17:199:19 | str indirection [string] | test.cpp:199:22:199:27 | string |
|
||||
| test.cpp:199:17:199:19 | str indirection [string] | test.cpp:199:22:199:27 | string indirection |
|
||||
| test.cpp:199:22:199:27 | string indirection | test.cpp:199:22:199:27 | string |
|
||||
| test.cpp:203:17:203:19 | str indirection [string] | test.cpp:203:22:203:27 | string |
|
||||
| test.cpp:203:17:203:19 | str indirection [string] | test.cpp:203:22:203:27 | string indirection |
|
||||
| test.cpp:203:22:203:27 | string indirection | test.cpp:203:22:203:27 | string |
|
||||
| test.cpp:207:17:207:19 | str indirection [string] | test.cpp:207:22:207:27 | string |
|
||||
| test.cpp:207:17:207:19 | str indirection [string] | test.cpp:207:22:207:27 | string indirection |
|
||||
| test.cpp:207:22:207:27 | string indirection | test.cpp:207:22:207:27 | string |
|
||||
| test.cpp:214:24:214:24 | p | test.cpp:216:10:216:10 | p |
|
||||
| test.cpp:220:43:220:48 | call to malloc | test.cpp:222:15:222:20 | buffer |
|
||||
| test.cpp:222:15:222:20 | buffer | test.cpp:214:24:214:24 | p |
|
||||
| test.cpp:228:43:228:48 | call to malloc | test.cpp:232:10:232:15 | buffer |
|
||||
| test.cpp:235:40:235:45 | buffer | test.cpp:236:5:236:26 | ... = ... |
|
||||
| test.cpp:236:5:236:26 | ... = ... | test.cpp:236:12:236:17 | p_str indirection [post update] [string] |
|
||||
| test.cpp:241:27:241:32 | call to malloc | test.cpp:242:22:242:27 | buffer |
|
||||
| test.cpp:242:16:242:19 | set_string output argument [string] | test.cpp:243:12:243:14 | str indirection [string] |
|
||||
| test.cpp:242:22:242:27 | buffer | test.cpp:235:40:235:45 | buffer |
|
||||
| test.cpp:242:22:242:27 | buffer | test.cpp:242:16:242:19 | set_string output argument [string] |
|
||||
| test.cpp:243:12:243:14 | str indirection [string] | test.cpp:243:12:243:21 | string |
|
||||
| test.cpp:243:12:243:14 | str indirection [string] | test.cpp:243:16:243:21 | string indirection |
|
||||
| test.cpp:243:16:243:21 | string indirection | test.cpp:243:12:243:21 | string |
|
||||
| test.cpp:249:20:249:27 | call to my_alloc | test.cpp:250:12:250:12 | p |
|
||||
| test.cpp:256:17:256:22 | call to malloc | test.cpp:257:12:257:12 | p |
|
||||
| test.cpp:262:22:262:27 | call to malloc | test.cpp:266:12:266:12 | p |
|
||||
| test.cpp:264:20:264:25 | call to malloc | test.cpp:266:12:266:12 | p |
|
||||
nodes
|
||||
| test.cpp:16:11:16:21 | mk_string_t indirection [string] | semmle.label | mk_string_t indirection [string] |
|
||||
| test.cpp:18:5:18:30 | ... = ... | semmle.label | ... = ... |
|
||||
| test.cpp:18:10:18:15 | str indirection [post update] [string] | semmle.label | str indirection [post update] [string] |
|
||||
| test.cpp:18:19:18:24 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:39:21:39:31 | call to mk_string_t indirection [string] | semmle.label | call to mk_string_t indirection [string] |
|
||||
| test.cpp:42:13:42:15 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:42:18:42:23 | string | semmle.label | string |
|
||||
| test.cpp:42:18:42:23 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:72:17:72:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:72:22:72:27 | string | semmle.label | string |
|
||||
| test.cpp:72:22:72:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:80:17:80:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:80:22:80:27 | string | semmle.label | string |
|
||||
| test.cpp:80:22:80:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:88:11:88:30 | mk_string_t_plus_one indirection [string] | semmle.label | mk_string_t_plus_one indirection [string] |
|
||||
| test.cpp:90:5:90:34 | ... = ... | semmle.label | ... = ... |
|
||||
| test.cpp:90:10:90:15 | str indirection [post update] [string] | semmle.label | str indirection [post update] [string] |
|
||||
| test.cpp:90:19:90:24 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:96:21:96:40 | call to mk_string_t_plus_one indirection [string] | semmle.label | call to mk_string_t_plus_one indirection [string] |
|
||||
| test.cpp:99:13:99:15 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:99:18:99:23 | string | semmle.label | string |
|
||||
| test.cpp:99:18:99:23 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:129:17:129:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:129:22:129:27 | string | semmle.label | string |
|
||||
| test.cpp:129:22:129:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:137:17:137:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:137:22:137:27 | string | semmle.label | string |
|
||||
| test.cpp:137:22:137:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:147:5:147:34 | ... = ... | semmle.label | ... = ... |
|
||||
| test.cpp:147:10:147:15 | str indirection [post update] [string] | semmle.label | str indirection [post update] [string] |
|
||||
| test.cpp:147:19:147:24 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:152:13:152:15 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:152:18:152:23 | string | semmle.label | string |
|
||||
| test.cpp:152:18:152:23 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:154:13:154:15 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:154:18:154:23 | string | semmle.label | string |
|
||||
| test.cpp:154:18:154:23 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:156:13:156:15 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:156:18:156:23 | string | semmle.label | string |
|
||||
| test.cpp:156:18:156:23 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:175:17:175:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:175:22:175:27 | string | semmle.label | string |
|
||||
| test.cpp:175:22:175:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:187:17:187:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:187:22:187:27 | string | semmle.label | string |
|
||||
| test.cpp:187:22:187:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:195:17:195:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:195:22:195:27 | string | semmle.label | string |
|
||||
| test.cpp:195:22:195:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:199:17:199:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:199:22:199:27 | string | semmle.label | string |
|
||||
| test.cpp:199:22:199:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:203:17:203:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:203:22:203:27 | string | semmle.label | string |
|
||||
| test.cpp:203:22:203:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:207:17:207:19 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:207:22:207:27 | string | semmle.label | string |
|
||||
| test.cpp:207:22:207:27 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:214:24:214:24 | p | semmle.label | p |
|
||||
| test.cpp:216:10:216:10 | p | semmle.label | p |
|
||||
| test.cpp:220:43:220:48 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:222:15:222:20 | buffer | semmle.label | buffer |
|
||||
| test.cpp:228:43:228:48 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:232:10:232:15 | buffer | semmle.label | buffer |
|
||||
| test.cpp:235:40:235:45 | buffer | semmle.label | buffer |
|
||||
| test.cpp:236:5:236:26 | ... = ... | semmle.label | ... = ... |
|
||||
| test.cpp:236:12:236:17 | p_str indirection [post update] [string] | semmle.label | p_str indirection [post update] [string] |
|
||||
| test.cpp:241:27:241:32 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:242:16:242:19 | set_string output argument [string] | semmle.label | set_string output argument [string] |
|
||||
| test.cpp:242:22:242:27 | buffer | semmle.label | buffer |
|
||||
| test.cpp:243:12:243:14 | str indirection [string] | semmle.label | str indirection [string] |
|
||||
| test.cpp:243:12:243:21 | string | semmle.label | string |
|
||||
| test.cpp:243:16:243:21 | string indirection | semmle.label | string indirection |
|
||||
| test.cpp:249:20:249:27 | call to my_alloc | semmle.label | call to my_alloc |
|
||||
| test.cpp:250:12:250:12 | p | semmle.label | p |
|
||||
| test.cpp:256:17:256:22 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:257:12:257:12 | p | semmle.label | p |
|
||||
| test.cpp:262:22:262:27 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:264:20:264:25 | call to malloc | semmle.label | call to malloc |
|
||||
| test.cpp:266:12:266:12 | p | semmle.label | p |
|
||||
subpaths
|
||||
| test.cpp:242:22:242:27 | buffer | test.cpp:235:40:235:45 | buffer | test.cpp:236:12:236:17 | p_str indirection [post update] [string] | test.cpp:242:16:242:19 | set_string output argument [string] |
|
||||
#select
|
||||
| test.cpp:42:5:42:11 | call to strncpy | test.cpp:18:19:18:24 | call to malloc | test.cpp:42:18:42:23 | string | This write may overflow $@ by 1 element. | test.cpp:42:18:42:23 | string | string |
|
||||
| test.cpp:72:9:72:15 | call to strncpy | test.cpp:18:19:18:24 | call to malloc | test.cpp:72:22:72:27 | string | This write may overflow $@ by 1 element. | test.cpp:72:22:72:27 | string | string |
|
||||
| test.cpp:80:9:80:15 | call to strncpy | test.cpp:18:19:18:24 | call to malloc | test.cpp:80:22:80:27 | string | This write may overflow $@ by 2 elements. | test.cpp:80:22:80:27 | string | string |
|
||||
| test.cpp:99:5:99:11 | call to strncpy | test.cpp:90:19:90:24 | call to malloc | test.cpp:99:18:99:23 | string | This write may overflow $@ by 1 element. | test.cpp:99:18:99:23 | string | string |
|
||||
| test.cpp:129:9:129:15 | call to strncpy | test.cpp:90:19:90:24 | call to malloc | test.cpp:129:22:129:27 | string | This write may overflow $@ by 1 element. | test.cpp:129:22:129:27 | string | string |
|
||||
| test.cpp:137:9:137:15 | call to strncpy | test.cpp:90:19:90:24 | call to malloc | test.cpp:137:22:137:27 | string | This write may overflow $@ by 2 elements. | test.cpp:137:22:137:27 | string | string |
|
||||
| test.cpp:152:5:152:11 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:152:18:152:23 | string | This write may overflow $@ by 1 element. | test.cpp:152:18:152:23 | string | string |
|
||||
| test.cpp:154:5:154:11 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:154:18:154:23 | string | This write may overflow $@ by 1 element. | test.cpp:154:18:154:23 | string | string |
|
||||
| test.cpp:156:5:156:11 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:156:18:156:23 | string | This write may overflow $@ by 2 elements. | test.cpp:156:18:156:23 | string | string |
|
||||
| test.cpp:175:9:175:15 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:175:22:175:27 | string | This write may overflow $@ by 1 element. | test.cpp:175:22:175:27 | string | string |
|
||||
| test.cpp:187:9:187:15 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:187:22:187:27 | string | This write may overflow $@ by 1 element. | test.cpp:187:22:187:27 | string | string |
|
||||
| test.cpp:195:9:195:15 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:195:22:195:27 | string | This write may overflow $@ by 1 element. | test.cpp:195:22:195:27 | string | string |
|
||||
| test.cpp:199:9:199:15 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:199:22:199:27 | string | This write may overflow $@ by 2 elements. | test.cpp:199:22:199:27 | string | string |
|
||||
| test.cpp:203:9:203:15 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:203:22:203:27 | string | This write may overflow $@ by 2 elements. | test.cpp:203:22:203:27 | string | string |
|
||||
| test.cpp:207:9:207:15 | call to strncpy | test.cpp:147:19:147:24 | call to malloc | test.cpp:207:22:207:27 | string | This write may overflow $@ by 3 elements. | test.cpp:207:22:207:27 | string | string |
|
||||
| test.cpp:243:5:243:10 | call to memset | test.cpp:241:27:241:32 | call to malloc | test.cpp:243:12:243:21 | string | This write may overflow $@ by 1 element. | test.cpp:243:16:243:21 | string | string |
|
||||
| test.cpp:250:5:250:10 | call to memset | test.cpp:249:20:249:27 | call to my_alloc | test.cpp:250:12:250:12 | p | This write may overflow $@ by 1 element. | test.cpp:250:12:250:12 | p | p |
|
||||
| test.cpp:266:5:266:10 | call to memset | test.cpp:262:22:262:27 | call to malloc | test.cpp:266:12:266:12 | p | This write may overflow $@ by 1 element. | test.cpp:266:12:266:12 | p | p |
|
||||
@@ -0,0 +1 @@
|
||||
Security/CWE/CWE-119/OverrunWriteProductFlow.ql
|
||||
267
cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
Normal file
267
cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
Normal file
@@ -0,0 +1,267 @@
|
||||
|
||||
typedef unsigned size_t;
|
||||
int sprintf(char *s, const char *format, ...);
|
||||
int snprintf(char *s, size_t n, const char *format, ...);
|
||||
int scanf(const char *format, ...);
|
||||
int sscanf(const char *s, const char *format, ...);
|
||||
char *malloc(size_t size);
|
||||
char *strncpy(char *dst, const char *src, size_t n);
|
||||
|
||||
typedef struct
|
||||
{
|
||||
char *string;
|
||||
unsigned size;
|
||||
} string_t;
|
||||
|
||||
string_t *mk_string_t(int size) {
|
||||
string_t *str = (string_t *) malloc(sizeof(string_t));
|
||||
str->string = malloc(size);
|
||||
str->size = size;
|
||||
return str;
|
||||
}
|
||||
|
||||
void test1(int size, char *buf) {
|
||||
string_t *str = mk_string_t(size);
|
||||
|
||||
strncpy(str->string, buf, str->size); // GOOD
|
||||
}
|
||||
|
||||
void strncpy_wrapper(string_t *str, char *buf) {
|
||||
strncpy(str->string, buf, str->size); // GOOD
|
||||
}
|
||||
|
||||
void test2(int size, char *buf) {
|
||||
string_t *str = mk_string_t(size);
|
||||
strncpy_wrapper(str, buf);
|
||||
}
|
||||
|
||||
void test3(unsigned size, char *buf, unsigned anotherSize) {
|
||||
string_t *str = mk_string_t(size);
|
||||
|
||||
strncpy(str->string, buf, str->size); // GOOD
|
||||
strncpy(str->string, buf, str->size + 1); // BAD
|
||||
|
||||
strncpy(str->string, buf, size); // GOOD
|
||||
strncpy(str->string, buf, size + 1); // BAD [NOT DETECTED]
|
||||
|
||||
if(anotherSize < str->size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < str->size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize <= size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size + 2) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize <= size + 2) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
|
||||
}
|
||||
}
|
||||
|
||||
string_t *mk_string_t_plus_one(int size) {
|
||||
string_t *str = (string_t *) malloc(sizeof(string_t));
|
||||
str->string = malloc(size + 1);
|
||||
str->size = size + 1;
|
||||
return str;
|
||||
}
|
||||
|
||||
void test4(unsigned size, char *buf, unsigned anotherSize) {
|
||||
string_t *str = mk_string_t_plus_one(size);
|
||||
|
||||
strncpy(str->string, buf, str->size); // GOOD
|
||||
strncpy(str->string, buf, str->size + 1); // BAD
|
||||
|
||||
strncpy(str->string, buf, size); // GOOD
|
||||
strncpy(str->string, buf, size + 1); // GOOD
|
||||
|
||||
if(anotherSize < str->size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < str->size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize <= size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size + 2) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize <= size + 2) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
|
||||
}
|
||||
}
|
||||
|
||||
void test5(unsigned size, char *buf, unsigned anotherSize) {
|
||||
string_t *str = (string_t *) malloc(sizeof(string_t));
|
||||
str->string = malloc(size - 1);
|
||||
str->size = size - 1;
|
||||
|
||||
strncpy(str->string, buf, str->size); // GOOD
|
||||
strncpy(str->string, buf, str->size - 1); // GOOD
|
||||
strncpy(str->string, buf, str->size + 1); // BAD
|
||||
|
||||
strncpy(str->string, buf, size); // BAD
|
||||
strncpy(str->string, buf, size - 1); // GOOD
|
||||
strncpy(str->string, buf, size + 1); // BAD
|
||||
|
||||
if(anotherSize < str->size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size - 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= size) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize <= size - 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < str->size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize < size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize < size - 1) {
|
||||
strncpy(str->string, buf, anotherSize); // GOOD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize <= size + 1) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize <= str->size + 2) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
|
||||
if(anotherSize <= size + 2) {
|
||||
strncpy(str->string, buf, anotherSize); // BAD
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void *memset(void *, int, unsigned);
|
||||
|
||||
void call_memset(void *p, unsigned size)
|
||||
{
|
||||
memset(p, 0, size); // GOOD
|
||||
}
|
||||
|
||||
void test_missing_call_context(unsigned char *unrelated_buffer, unsigned size) {
|
||||
unsigned char* buffer = (unsigned char*)malloc(size);
|
||||
call_memset(unrelated_buffer, size + 5);
|
||||
call_memset(buffer, size);
|
||||
}
|
||||
|
||||
bool unknown();
|
||||
|
||||
void repeated_alerts(unsigned size, unsigned offset) {
|
||||
unsigned char* buffer = (unsigned char*)malloc(size);
|
||||
while(unknown()) {
|
||||
++size;
|
||||
}
|
||||
memset(buffer, 0, size); // BAD [NOT DETECTED]
|
||||
}
|
||||
|
||||
void set_string(string_t* p_str, char* buffer) {
|
||||
p_str->string = buffer;
|
||||
}
|
||||
|
||||
void test_flow_through_setter(unsigned size) {
|
||||
string_t str;
|
||||
char* buffer = (char*)malloc(size);
|
||||
set_string(&str, buffer);
|
||||
memset(str.string, 0, size + 1); // BAD
|
||||
}
|
||||
|
||||
void* my_alloc(unsigned size);
|
||||
|
||||
void foo(unsigned size) {
|
||||
int* p = (int*)my_alloc(size); // BAD
|
||||
memset(p, 0, size + 1);
|
||||
}
|
||||
|
||||
void test6(unsigned long n, char *p) {
|
||||
while (unknown()) {
|
||||
n++;
|
||||
p = (char *)malloc(n);
|
||||
memset(p, 0, n); // GOOD
|
||||
}
|
||||
}
|
||||
|
||||
void test7(unsigned n) {
|
||||
char* p = (char*)malloc(n);
|
||||
if(!p) {
|
||||
p = (char*)malloc(++n);
|
||||
}
|
||||
memset(p, 0, n); // GOOD [FALSE POSITIVE]
|
||||
}
|
||||
Reference in New Issue
Block a user