hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Change to cpp/overflow-buffer to detect access to an array using a negative index (static, out of range access, lower bound).

Browse Source
This commit is contained in:
Raul Garcia
2018-09-13 15:44:32 -07:00
parent 6266d8bf01
commit 28050e1415
2 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.gitignore vendored
View File

@@ -8,3 +8,7 @@
# qltest projects and artifacts # qltest projects and artifacts
*/ql/test/**/*.testproj */ql/test/**/*.testproj
*/ql/test/**/*.actual */ql/test/**/*.actual
/.vs/slnx.sqlite
/.vs/ql/v15/Browse.VC.opendb
/.vs/ql/v15/Browse.VC.db
/.vs/ProjectSettings.json

13
cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.ql
View File

@@ -29,7 +29,7 @@ from BufferAccess ba, string bufferDesc, int accessSize, int accessType,
where accessSize = ba.getSize() where accessSize = ba.getSize()
and bufferSize = getBufferSize(ba.getBuffer(bufferDesc, accessType), and bufferSize = getBufferSize(ba.getBuffer(bufferDesc, accessType),
bufferAlloc) bufferAlloc)
and accessSize > bufferSize and (accessSize > bufferSize or (accessSize <= 0 and accessType = 3))
and if accessType = 1 then ( and if accessType = 1 then (
message = "This '" + ba.getName() + "' operation accesses " message = "This '" + ba.getName() + "' operation accesses "
+ plural(accessSize, " byte", " bytes") + plural(accessSize, " byte", " bytes")
@@ -41,8 +41,13 @@ where accessSize = ba.getSize()
+ " but the $@ is only " + " but the $@ is only "
+ plural(bufferSize, " byte", " bytes") + "." + plural(bufferSize, " byte", " bytes") + "."
) else ( ) else (
message = "This array indexing operation accesses byte offset " if accessSize > 0 then (
+ (accessSize - 1) + " but the $@ is only " message = "This array indexing operation accesses byte offset "
+ plural(bufferSize, " byte", " bytes") + "." + (accessSize - 1) + " but the $@ is only "
+ plural(bufferSize, " byte", " bytes") + "."
) else (
message = "This array indexing operation accesses a negative index "
+ ((accessSize/ba.getActualType().getSize()) - 1) + " on the $@."
)
) )
select ba, message, bufferAlloc, bufferDesc select ba, message, bufferAlloc, bufferDesc