From 2164069eda72f78d0deb9db7bc16d1d3ff6557dd Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 11 Aug 2023 12:00:43 +0100 Subject: [PATCH] C++: Add another testcase. --- .../pointer-deref/InvalidPointerDeref.expected | 11 +++++++++++ .../Security/CWE/CWE-193/pointer-deref/test.cpp | 10 +++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected index ef339b46b6e..8268a1beaf4 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected @@ -222,6 +222,12 @@ edges | test.cpp:705:18:705:18 | q | test.cpp:706:12:706:13 | * ... | | test.cpp:711:13:711:26 | new[] | test.cpp:714:11:714:11 | q | | test.cpp:714:11:714:11 | q | test.cpp:705:18:705:18 | q | +| test.cpp:730:12:730:28 | new[] | test.cpp:732:16:732:26 | ... + ... | +| test.cpp:730:12:730:28 | new[] | test.cpp:732:16:732:26 | ... + ... | +| test.cpp:730:12:730:28 | new[] | test.cpp:733:5:733:12 | ... = ... | +| test.cpp:732:16:732:26 | ... + ... | test.cpp:732:16:732:26 | ... + ... | +| test.cpp:732:16:732:26 | ... + ... | test.cpp:733:5:733:12 | ... = ... | +| test.cpp:732:16:732:26 | ... + ... | test.cpp:733:5:733:12 | ... = ... | nodes | test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc | | test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... | @@ -372,6 +378,10 @@ nodes | test.cpp:706:12:706:13 | * ... | semmle.label | * ... | | test.cpp:711:13:711:26 | new[] | semmle.label | new[] | | test.cpp:714:11:714:11 | q | semmle.label | q | +| test.cpp:730:12:730:28 | new[] | semmle.label | new[] | +| test.cpp:732:16:732:26 | ... + ... | semmle.label | ... + ... | +| test.cpp:732:16:732:26 | ... + ... | semmle.label | ... + ... | +| test.cpp:733:5:733:12 | ... = ... | semmle.label | ... = ... | subpaths #select | test.cpp:6:14:6:15 | * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size | @@ -406,3 +416,4 @@ subpaths | test.cpp:647:5:647:19 | ... = ... | test.cpp:642:14:642:31 | new[] | test.cpp:647:5:647:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:642:14:642:31 | new[] | new[] | test.cpp:647:8:647:14 | src_pos | src_pos | | test.cpp:701:15:701:16 | * ... | test.cpp:695:13:695:26 | new[] | test.cpp:701:15:701:16 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:695:13:695:26 | new[] | new[] | test.cpp:696:19:696:22 | size | size | | test.cpp:706:12:706:13 | * ... | test.cpp:711:13:711:26 | new[] | test.cpp:706:12:706:13 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:711:13:711:26 | new[] | new[] | test.cpp:712:19:712:22 | size | size | +| test.cpp:733:5:733:12 | ... = ... | test.cpp:730:12:730:28 | new[] | test.cpp:733:5:733:12 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:730:12:730:28 | new[] | new[] | test.cpp:732:21:732:25 | ... + ... | ... + ... | diff --git a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp index cfb37e168c2..b7a0386cd6b 100644 --- a/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp +++ b/cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp @@ -724,4 +724,12 @@ void test21_simple(bool b) { for (int i = 0; i < n; i += 2) { xs[i+1] = 0; // GOOD } -} \ No newline at end of file +} + +void test36(unsigned size, unsigned n) { + int* p = new int[size + 2]; + if(n < size + 1) { + int* end = p + (n + 2); // $ alloc=L730+2 + *end = 0; // $ deref=L733 // BAD + } +}