From 223eeb69212eac45f58e713d320d343b67cdf700 Mon Sep 17 00:00:00 2001 From: Jeroen Ketema Date: Thu, 24 Nov 2022 14:38:36 +0100 Subject: [PATCH] C++: Fix upper bound detection in default taint flow --- .../cpp/ir/dataflow/DefaultTaintTracking.qll | 2 +- .../CWE/CWE-190/TaintedAllocationSize.ql | 2 +- .../security-taint/tainted_diff.expected | 4 --- .../security-taint/tainted_ir.expected | 4 --- .../ArithmeticWithExtremeValues.expected | 1 - .../TaintedAllocationSize.expected | 30 ------------------- .../semmle/tainted/ArithmeticTainted.expected | 9 ------ .../tainted/IntegerOverflowTainted.expected | 1 - 8 files changed, 2 insertions(+), 51 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll index 1ac1340fb8c..3b687615a6a 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll @@ -175,7 +175,7 @@ private module Cached { cached predicate nodeIsBarrier(DataFlow::Node node) { exists(Variable checkedVar | - readsVariable(node.asInstruction(), checkedVar) and + node.asExpr().(VariableAccess).getTarget() = checkedVar and hasUpperBoundsCheck(checkedVar) ) or diff --git a/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql index a7664122d1d..9697b5f3a95 100644 --- a/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql +++ b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql @@ -81,7 +81,7 @@ class TaintedAllocationSizeConfiguration extends TaintTracking::Configuration { ) or exists(Variable checkedVar | - readsVariable(node.asInstruction(), checkedVar) and + node.asExpr().(VariableAccess).getTarget() = checkedVar and hasUpperBoundsCheck(checkedVar) ) or diff --git a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected index 231d69cdd5f..9495e98ca24 100644 --- a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected +++ b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.expected @@ -25,10 +25,6 @@ | test.cpp:68:28:68:33 | call to getenv | test.cpp:70:12:70:15 | copy | AST only | | test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | array to pointer conversion | IR only | | test.cpp:75:20:75:25 | call to getenv | test.cpp:15:22:15:25 | nptr | AST only | -| test.cpp:75:20:75:25 | call to getenv | test.cpp:76:9:76:11 | len | IR only | -| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:38 | (unsigned long)... | IR only | -| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:38 | len | IR only | -| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:55 | ... * ... | IR only | | test.cpp:83:28:83:33 | call to getenv | test.cpp:8:24:8:25 | s1 | AST only | | test.cpp:83:28:83:33 | call to getenv | test.cpp:11:20:11:21 | s1 | AST only | | test.cpp:83:28:83:33 | call to getenv | test.cpp:11:36:11:37 | s2 | AST only | diff --git a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected index ebd51bf2bc5..c7f6b022e57 100644 --- a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected +++ b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_ir.expected @@ -25,10 +25,6 @@ | test.cpp:75:20:75:25 | call to getenv | test.cpp:75:15:75:18 | call to atoi | | test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:25 | call to getenv | | test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:45 | (const char *)... | -| test.cpp:75:20:75:25 | call to getenv | test.cpp:76:9:76:11 | len | -| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:38 | (unsigned long)... | -| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:38 | len | -| test.cpp:75:20:75:25 | call to getenv | test.cpp:77:36:77:55 | ... * ... | | test.cpp:83:28:83:33 | call to getenv | test.cpp:83:28:83:33 | call to getenv | | test.cpp:83:28:83:33 | call to getenv | test.cpp:83:28:83:46 | (const char *)... | | test.cpp:83:28:83:33 | call to getenv | test.cpp:86:15:86:22 | userName | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/ArithmeticWithExtremeValues.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/ArithmeticWithExtremeValues.expected index eac1406e8ca..c8d2e10bd85 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/ArithmeticWithExtremeValues.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/ArithmeticWithExtremeValues.expected @@ -3,5 +3,4 @@ | test.c:50:3:50:5 | sc3 | $@ flows to an operand of an arithmetic expression, potentially causing an overflow. | test.c:49:9:49:16 | 127 | Extreme value | | test.c:59:3:59:5 | sc6 | $@ flows to an operand of an arithmetic expression, potentially causing an overflow. | test.c:58:9:58:16 | 127 | Extreme value | | test.c:63:3:63:5 | sc8 | $@ flows to an operand of an arithmetic expression, potentially causing an underflow. | test.c:62:9:62:16 | - ... | Extreme value | -| test.c:104:9:104:9 | x | $@ flows to an operand of an arithmetic expression, potentially causing an overflow. | test.c:98:17:98:23 | 2147483647 | Extreme value | | test.c:124:9:124:9 | x | $@ flows to an operand of an arithmetic expression, potentially causing an overflow. | test.c:118:17:118:23 | 2147483647 | Extreme value | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected index 277ad0b3e29..b9a5f2074de 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected @@ -5,25 +5,15 @@ edges | test.cpp:40:21:40:24 | argv | test.cpp:49:32:49:35 | size | | test.cpp:40:21:40:24 | argv | test.cpp:50:26:50:29 | size | | test.cpp:40:21:40:24 | argv | test.cpp:53:35:53:60 | ... * ... | -| test.cpp:124:18:124:23 | call to getenv | test.cpp:125:29:125:32 | size | | test.cpp:124:18:124:23 | call to getenv | test.cpp:128:24:128:41 | ... * ... | -| test.cpp:124:18:124:31 | call to getenv indirection | test.cpp:125:29:125:32 | size | | test.cpp:124:18:124:31 | call to getenv indirection | test.cpp:128:24:128:41 | ... * ... | -| test.cpp:125:29:125:32 | size | test.cpp:127:24:127:49 | ... * ... | | test.cpp:133:19:133:24 | call to getenv | test.cpp:135:10:135:27 | ... * ... | | test.cpp:133:19:133:32 | call to getenv indirection | test.cpp:135:10:135:27 | ... * ... | | test.cpp:148:20:148:25 | call to getenv | test.cpp:152:11:152:28 | ... * ... | | test.cpp:148:20:148:33 | call to getenv indirection | test.cpp:152:11:152:28 | ... * ... | -| test.cpp:157:19:157:24 | call to getenv | test.cpp:161:11:161:28 | ... * ... | -| test.cpp:157:19:157:32 | call to getenv indirection | test.cpp:161:11:161:28 | ... * ... | -| test.cpp:184:19:184:24 | call to getenv | test.cpp:186:10:186:27 | ... * ... | -| test.cpp:184:19:184:32 | call to getenv indirection | test.cpp:186:10:186:27 | ... * ... | | test.cpp:209:8:209:23 | VariableAddress indirection | test.cpp:241:9:241:24 | call to get_tainted_size | | test.cpp:211:14:211:19 | call to getenv | test.cpp:209:8:209:23 | VariableAddress indirection | | test.cpp:211:14:211:27 | call to getenv indirection | test.cpp:209:8:209:23 | VariableAddress indirection | -| test.cpp:214:8:214:23 | VariableAddress indirection | test.cpp:242:9:242:24 | call to get_bounded_size | -| test.cpp:216:18:216:23 | call to getenv | test.cpp:214:8:214:23 | VariableAddress indirection | -| test.cpp:216:18:216:31 | call to getenv indirection | test.cpp:214:8:214:23 | VariableAddress indirection | | test.cpp:224:23:224:23 | s | test.cpp:225:21:225:21 | s | | test.cpp:230:21:230:21 | s | test.cpp:231:21:231:21 | s | | test.cpp:237:24:237:29 | call to getenv | test.cpp:239:9:239:18 | local_size | @@ -52,8 +42,6 @@ nodes | test.cpp:53:35:53:60 | ... * ... | semmle.label | ... * ... | | test.cpp:124:18:124:23 | call to getenv | semmle.label | call to getenv | | test.cpp:124:18:124:31 | call to getenv indirection | semmle.label | call to getenv indirection | -| test.cpp:125:29:125:32 | size | semmle.label | size | -| test.cpp:127:24:127:49 | ... * ... | semmle.label | ... * ... | | test.cpp:128:24:128:41 | ... * ... | semmle.label | ... * ... | | test.cpp:133:19:133:24 | call to getenv | semmle.label | call to getenv | | test.cpp:133:19:133:32 | call to getenv indirection | semmle.label | call to getenv indirection | @@ -61,18 +49,9 @@ nodes | test.cpp:148:20:148:25 | call to getenv | semmle.label | call to getenv | | test.cpp:148:20:148:33 | call to getenv indirection | semmle.label | call to getenv indirection | | test.cpp:152:11:152:28 | ... * ... | semmle.label | ... * ... | -| test.cpp:157:19:157:24 | call to getenv | semmle.label | call to getenv | -| test.cpp:157:19:157:32 | call to getenv indirection | semmle.label | call to getenv indirection | -| test.cpp:161:11:161:28 | ... * ... | semmle.label | ... * ... | -| test.cpp:184:19:184:24 | call to getenv | semmle.label | call to getenv | -| test.cpp:184:19:184:32 | call to getenv indirection | semmle.label | call to getenv indirection | -| test.cpp:186:10:186:27 | ... * ... | semmle.label | ... * ... | | test.cpp:209:8:209:23 | VariableAddress indirection | semmle.label | VariableAddress indirection | | test.cpp:211:14:211:19 | call to getenv | semmle.label | call to getenv | | test.cpp:211:14:211:27 | call to getenv indirection | semmle.label | call to getenv indirection | -| test.cpp:214:8:214:23 | VariableAddress indirection | semmle.label | VariableAddress indirection | -| test.cpp:216:18:216:23 | call to getenv | semmle.label | call to getenv | -| test.cpp:216:18:216:31 | call to getenv indirection | semmle.label | call to getenv indirection | | test.cpp:224:23:224:23 | s | semmle.label | s | | test.cpp:225:21:225:21 | s | semmle.label | s | | test.cpp:230:21:230:21 | s | semmle.label | s | @@ -81,7 +60,6 @@ nodes | test.cpp:237:24:237:37 | call to getenv indirection | semmle.label | call to getenv indirection | | test.cpp:239:9:239:18 | local_size | semmle.label | local_size | | test.cpp:241:9:241:24 | call to get_tainted_size | semmle.label | call to get_tainted_size | -| test.cpp:242:9:242:24 | call to get_bounded_size | semmle.label | call to get_bounded_size | | test.cpp:245:11:245:20 | local_size | semmle.label | local_size | | test.cpp:247:10:247:19 | local_size | semmle.label | local_size | | test.cpp:250:20:250:27 | Load indirection | semmle.label | Load indirection | @@ -102,18 +80,12 @@ subpaths | test.cpp:49:25:49:30 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) | | test.cpp:50:17:50:30 | new[] | test.cpp:40:21:40:24 | argv | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) | | test.cpp:53:21:53:27 | call to realloc | test.cpp:40:21:40:24 | argv | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) | -| test.cpp:127:17:127:22 | call to malloc | test.cpp:124:18:124:23 | call to getenv | test.cpp:127:24:127:49 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:124:18:124:23 | call to getenv | user input (an environment variable) | -| test.cpp:127:17:127:22 | call to malloc | test.cpp:124:18:124:31 | call to getenv indirection | test.cpp:127:24:127:49 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:124:18:124:31 | call to getenv indirection | user input (an environment variable) | | test.cpp:128:17:128:22 | call to malloc | test.cpp:124:18:124:23 | call to getenv | test.cpp:128:24:128:41 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:124:18:124:23 | call to getenv | user input (an environment variable) | | test.cpp:128:17:128:22 | call to malloc | test.cpp:124:18:124:31 | call to getenv indirection | test.cpp:128:24:128:41 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:124:18:124:31 | call to getenv indirection | user input (an environment variable) | | test.cpp:135:3:135:8 | call to malloc | test.cpp:133:19:133:24 | call to getenv | test.cpp:135:10:135:27 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:133:19:133:24 | call to getenv | user input (an environment variable) | | test.cpp:135:3:135:8 | call to malloc | test.cpp:133:19:133:32 | call to getenv indirection | test.cpp:135:10:135:27 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:133:19:133:32 | call to getenv indirection | user input (an environment variable) | | test.cpp:152:4:152:9 | call to malloc | test.cpp:148:20:148:25 | call to getenv | test.cpp:152:11:152:28 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:148:20:148:25 | call to getenv | user input (an environment variable) | | test.cpp:152:4:152:9 | call to malloc | test.cpp:148:20:148:33 | call to getenv indirection | test.cpp:152:11:152:28 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:148:20:148:33 | call to getenv indirection | user input (an environment variable) | -| test.cpp:161:4:161:9 | call to malloc | test.cpp:157:19:157:24 | call to getenv | test.cpp:161:11:161:28 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:157:19:157:24 | call to getenv | user input (an environment variable) | -| test.cpp:161:4:161:9 | call to malloc | test.cpp:157:19:157:32 | call to getenv indirection | test.cpp:161:11:161:28 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:157:19:157:32 | call to getenv indirection | user input (an environment variable) | -| test.cpp:186:3:186:8 | call to malloc | test.cpp:184:19:184:24 | call to getenv | test.cpp:186:10:186:27 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:184:19:184:24 | call to getenv | user input (an environment variable) | -| test.cpp:186:3:186:8 | call to malloc | test.cpp:184:19:184:32 | call to getenv indirection | test.cpp:186:10:186:27 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:184:19:184:32 | call to getenv indirection | user input (an environment variable) | | test.cpp:225:14:225:19 | call to malloc | test.cpp:237:24:237:29 | call to getenv | test.cpp:225:21:225:21 | s | This allocation size is derived from $@ and might overflow. | test.cpp:237:24:237:29 | call to getenv | user input (an environment variable) | | test.cpp:225:14:225:19 | call to malloc | test.cpp:237:24:237:37 | call to getenv indirection | test.cpp:225:21:225:21 | s | This allocation size is derived from $@ and might overflow. | test.cpp:237:24:237:37 | call to getenv indirection | user input (an environment variable) | | test.cpp:231:14:231:19 | call to malloc | test.cpp:237:24:237:29 | call to getenv | test.cpp:231:21:231:21 | s | This allocation size is derived from $@ and might overflow. | test.cpp:237:24:237:29 | call to getenv | user input (an environment variable) | @@ -122,8 +94,6 @@ subpaths | test.cpp:239:2:239:7 | call to malloc | test.cpp:237:24:237:37 | call to getenv indirection | test.cpp:239:9:239:18 | local_size | This allocation size is derived from $@ and might overflow. | test.cpp:237:24:237:37 | call to getenv indirection | user input (an environment variable) | | test.cpp:241:2:241:7 | call to malloc | test.cpp:211:14:211:19 | call to getenv | test.cpp:241:9:241:24 | call to get_tainted_size | This allocation size is derived from $@ and might overflow. | test.cpp:211:14:211:19 | call to getenv | user input (an environment variable) | | test.cpp:241:2:241:7 | call to malloc | test.cpp:211:14:211:27 | call to getenv indirection | test.cpp:241:9:241:24 | call to get_tainted_size | This allocation size is derived from $@ and might overflow. | test.cpp:211:14:211:27 | call to getenv indirection | user input (an environment variable) | -| test.cpp:242:2:242:7 | call to malloc | test.cpp:216:18:216:23 | call to getenv | test.cpp:242:9:242:24 | call to get_bounded_size | This allocation size is derived from $@ and might overflow. | test.cpp:216:18:216:23 | call to getenv | user input (an environment variable) | -| test.cpp:242:2:242:7 | call to malloc | test.cpp:216:18:216:31 | call to getenv indirection | test.cpp:242:9:242:24 | call to get_bounded_size | This allocation size is derived from $@ and might overflow. | test.cpp:216:18:216:31 | call to getenv indirection | user input (an environment variable) | | test.cpp:263:4:263:9 | call to malloc | test.cpp:259:20:259:25 | call to getenv | test.cpp:263:11:263:29 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:259:20:259:25 | call to getenv | user input (an environment variable) | | test.cpp:263:4:263:9 | call to malloc | test.cpp:259:20:259:33 | call to getenv indirection | test.cpp:263:11:263:29 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:259:20:259:33 | call to getenv indirection | user input (an environment variable) | | test.cpp:291:4:291:9 | call to malloc | test.cpp:251:18:251:23 | call to getenv | test.cpp:291:11:291:28 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:251:18:251:23 | call to getenv | user input (an environment variable) | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected index f5590a73e32..c36756a15b7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected @@ -15,10 +15,6 @@ edges | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | -| test.c:17:30:17:33 | argv | test.c:19:17:19:31 | maxConnections2 | -| test.c:17:30:17:33 | argv | test.c:19:17:19:31 | maxConnections2 | -| test.c:17:30:17:33 | argv | test.c:19:17:19:31 | maxConnections2 | -| test.c:17:30:17:33 | argv | test.c:19:17:19:31 | maxConnections2 | | test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 | | test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 | | test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 | @@ -47,10 +43,6 @@ nodes | test.c:11:29:11:32 | argv | semmle.label | argv | | test.c:14:15:14:28 | maxConnections | semmle.label | maxConnections | | test.c:14:15:14:28 | maxConnections | semmle.label | maxConnections | -| test.c:17:30:17:33 | argv | semmle.label | argv | -| test.c:17:30:17:33 | argv | semmle.label | argv | -| test.c:19:17:19:31 | maxConnections2 | semmle.label | maxConnections2 | -| test.c:19:17:19:31 | maxConnections2 | semmle.label | maxConnections2 | | test.c:41:17:41:20 | argv | semmle.label | argv | | test.c:41:17:41:20 | argv | semmle.label | argv | | test.c:44:7:44:10 | len2 | semmle.label | len2 | @@ -67,6 +59,5 @@ nodes | test5.cpp:19:6:19:6 | y | test5.cpp:9:7:9:9 | buf | test5.cpp:19:6:19:6 | y | $@ flows to an operand of an arithmetic expression, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value | | test.c:14:15:14:28 | maxConnections | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | $@ flows to an operand of an arithmetic expression, potentially causing an overflow. | test.c:11:29:11:32 | argv | User-provided value | | test.c:14:15:14:28 | maxConnections | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | $@ flows to an operand of an arithmetic expression, potentially causing an underflow. | test.c:11:29:11:32 | argv | User-provided value | -| test.c:19:17:19:31 | maxConnections2 | test.c:17:30:17:33 | argv | test.c:19:17:19:31 | maxConnections2 | $@ flows to an operand of an arithmetic expression, potentially causing an underflow. | test.c:17:30:17:33 | argv | User-provided value | | test.c:44:7:44:10 | len2 | test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 | $@ flows to an operand of an arithmetic expression, potentially causing an underflow. | test.c:41:17:41:20 | argv | User-provided value | | test.c:54:7:54:10 | len3 | test.c:51:17:51:20 | argv | test.c:54:7:54:10 | len3 | $@ flows to an operand of an arithmetic expression, potentially causing an underflow. | test.c:51:17:51:20 | argv | User-provided value | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected index 6e65c5dc8a8..b57dfe0c512 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected @@ -12,6 +12,5 @@ | test6.cpp:16:15:16:15 | s | $@ flows an expression which might overflow. | test6.cpp:39:23:39:24 | & ... | User-provided value | | test6.cpp:30:16:30:16 | s | $@ flows an expression which might overflow. | test6.cpp:39:23:39:24 | & ... | User-provided value | | test.c:14:15:14:35 | ... * ... | $@ flows an expression which might overflow. | test.c:11:29:11:32 | argv | User-provided value | -| test.c:19:17:19:38 | ... * ... | $@ flows an expression which might overflow negatively. | test.c:17:30:17:33 | argv | User-provided value | | test.c:44:7:44:12 | ... -- | $@ flows an expression which might overflow negatively. | test.c:41:17:41:20 | argv | User-provided value | | test.c:54:7:54:12 | ... -- | $@ flows an expression which might overflow negatively. | test.c:51:17:51:20 | argv | User-provided value |