hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 12:46:34 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add in-barrier on sources to reduce duplication.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-05-24 15:50:00 -07:00
parent 64d7b4923d
commit 298013a57e
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
View File

@@ -84,7 +84,10 @@ predicate pointerArithOverflow0(
pai.getElementSize() = f.getUnspecifiedType().(ArrayType).getBaseType().getSize() and
f.getUnspecifiedType().(ArrayType).getArraySize() = size and
semBounded(getSemanticExpr(pai.getRight()), any(SemZeroBound b), bound, true, _) and
delta = bound - size
delta = bound - size and
delta >= 0 and
size != 0 and
size != 1
}
module PointerArithmeticToDerefConfig implements DataFlow::ConfigSig {
@@ -92,6 +95,8 @@ module PointerArithmeticToDerefConfig implements DataFlow::ConfigSig {
pointerArithOverflow0(source.asInstruction(), _, _, _, _)
}
predicate isBarrierIn(DataFlow::Node node) { isSource(node) }
predicate isSink(DataFlow::Node sink) { isInvalidPointerDerefSink1(sink, _, _) }
}
@@ -127,18 +132,17 @@ module FieldAddressToDerefConfig implements DataFlow::StateConfigSig {
predicate isBarrier(DataFlow::Node node, FlowState state) { none() }
predicate isBarrierIn(DataFlow::Node node) { isSource(node, _) }
predicate isAdditionalFlowStep(
DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2
) {
exists(PointerArithmeticInstruction pai, Field f, int size, int delta |
exists(PointerArithmeticInstruction pai, Field f |
state1 = TArray(f) and
state2 = TOverflowArithmetic(pai) and
pai.getLeft() = node1.asInstruction() and
node2.asInstruction() = pai and
pointerArithOverflow(pai, f, size, _, delta) and
delta >= 0 and
size != 0 and
size != 1
pointerArithOverflow(pai, f, _, _, _)
)
}
}