hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 21:25:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add tests.

Browse Source
This commit is contained in:
Geoffrey White
2021-07-28 15:23:55 +01:00
parent a5f0a4ea71
commit 358d89f3ce
3 changed files with 231 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTermination.expected Normal file
View File

@@ -0,0 +1,19 @@
| test.cpp:25:10:25:16 | buffer1 | Variable $@ may not be null terminated. | test.cpp:22:8:22:14 | buffer1 | buffer1 |
| test.cpp:26:10:26:16 | buffer2 | Variable $@ may not be null terminated. | test.cpp:23:8:23:14 | buffer2 | buffer2 |
| test.cpp:39:10:39:16 | buffer2 | Variable $@ may not be null terminated. | test.cpp:35:8:35:14 | buffer2 | buffer2 |
| test.cpp:59:10:59:13 | ptr1 | Variable $@ may not be null terminated. | test.cpp:56:9:56:12 | ptr1 | ptr1 |
| test.cpp:69:10:69:16 | buffer1 | Variable $@ may not be null terminated. | test.cpp:64:8:64:14 | buffer1 | buffer1 |
| test.cpp:70:10:70:12 | ptr | Variable $@ may not be null terminated. | test.cpp:64:8:64:14 | buffer1 | buffer1 |
| test.cpp:81:10:81:16 | buffer2 | Variable $@ may not be null terminated. | test.cpp:65:8:65:14 | buffer2 | buffer2 |
| test.cpp:82:10:82:12 | ptr | Variable $@ may not be null terminated. | test.cpp:65:8:65:14 | buffer2 | buffer2 |
| test.cpp:93:10:93:15 | buffer | Variable $@ may not be null terminated. | test.cpp:86:8:86:13 | buffer | buffer |
| test.cpp:116:10:116:15 | buffer | Variable $@ may not be null terminated. | test.cpp:109:8:109:13 | buffer | buffer |
| test.cpp:130:14:130:19 | buffer | Variable $@ may not be null terminated. | test.cpp:127:7:127:12 | buffer | buffer |
| test.cpp:139:10:139:15 | buffer | Variable $@ may not be null terminated. | test.cpp:136:8:136:13 | buffer | buffer |
| test.cpp:154:10:154:15 | buffer | Variable $@ may not be null terminated. | test.cpp:151:8:151:13 | buffer | buffer |
| test.cpp:162:10:162:15 | buffer | Variable $@ may not be null terminated. | test.cpp:158:8:158:13 | buffer | buffer |
| test.cpp:170:10:170:15 | buffer | Variable $@ may not be null terminated. | test.cpp:166:8:166:13 | buffer | buffer |
| test.cpp:186:10:186:15 | buffer | Variable $@ may not be null terminated. | test.cpp:183:9:183:14 | buffer | buffer |
| test.cpp:194:10:194:15 | buffer | Variable $@ may not be null terminated. | test.cpp:190:9:190:14 | buffer | buffer |
| test.cpp:201:10:201:15 | buffer | Variable $@ may not be null terminated. | test.cpp:198:9:198:14 | buffer | buffer |
| test.cpp:209:10:209:15 | buffer | Variable $@ may not be null terminated. | test.cpp:205:9:205:14 | buffer | buffer |

1
cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/ImproperNullTermination.qlref Normal file
View File

@@ -0,0 +1 @@
Likely Bugs/Memory Management/ImproperNullTermination.ql

211
cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp Normal file
View File

@@ -0,0 +1,211 @@
typedef unsigned int size_t;
typedef signed int ssize_t;
size_t strlen(const char *s);
char *strcpy(char *s1, const char *s2);
char *strdup(const char *s1);
void *malloc(size_t size);
void *memset(void *s, int c, size_t n);
void *memcpy(void *s1, const void *s2, size_t n);
ssize_t readlink(const char *path, char *buffer, size_t buffer_size);
ssize_t readlinkat(int fd, const char *path, char *buffer, size_t buffer_size);
bool cond();
void test_unassigned()
{
{
char buffer1[1024];
char buffer2[1024];
strdup(buffer1); // BAD
strdup(buffer2); // BAD
memcpy(buffer2, buffer1, sizeof(buffer2));
strdup(buffer1); // BAD [NOT DETECTED]
strdup(buffer2); // BAD [NOT DETECTED]
}
{
char buffer1[1024];
char buffer2[1024];
strcpy(buffer1, "content");
strdup(buffer1); // GOOD
strdup(buffer2); // BAD
memcpy(buffer2, buffer1, sizeof(buffer2));
strdup(buffer1); // GOOD
strdup(buffer2); // GOOD
}
{
char buffer1[1024] = {0};
char buffer2[1024];
memset(buffer2, 0, sizeof(buffer2));
strdup(buffer1); // GOOD
strdup(buffer2); // GOOD
}
{
char *ptr1;
char *ptr2 = "content";
strdup(ptr1); // BAD
strdup(ptr2); // GOOD
}
{
char buffer1[1024];
char buffer2[1024];
char *ptr;
ptr = buffer1;
strdup(buffer1); // BAD
strdup(ptr); // BAD
strcpy(buffer1, "content");
strdup(buffer1); // GOOD
strdup(ptr); // GOOD
ptr = buffer1;
strdup(buffer1); // GOOD
strdup(ptr); // GOOD
ptr = buffer2;
strdup(buffer2); // BAD
strdup(ptr); // BAD
}
{
char buffer[1024];
if (cond())
{
strcpy(buffer, "content");
strdup(buffer); // GOOD
}
strdup(buffer); // BAD
}
{
char buffer[1024];
if (cond())
{
strcpy(buffer, "content");
} else {
strcpy(buffer, "alternative");
}
strdup(buffer); // GOOD
}
{
char buffer[1024];
while (cond())
{
strcpy(buffer, "content");
strdup(buffer); // GOOD
}
strdup(buffer); // BAD
}
}
void test_callee(char *p1, char *p2)
{
strdup(p1);
}
void test_caller()
{
char buffer[1024];
test_callee("content", buffer); // GOOD
test_callee(buffer, "content"); // BAD
}
void test_readlink(int fd, const char *path, size_t sz)
{
{
char buffer[1024];
readlink(path, buffer, sizeof(buffer));
strdup(buffer); // BAD
}
{
char buffer[1024];
int v;
readlinkat(fd, path, buffer, sizeof(buffer));
v = strlen(buffer); // BAD [NOT DETECTED]
}
{
char buffer[1024] = {0};
readlink(path, buffer, sizeof(buffer) - 1);
strdup(buffer); // GOOD [FALSE POSITIVE]
}
{
char buffer[1024];
memset(buffer, 0, sizeof(buffer));
readlink(path, buffer, sizeof(buffer) - 1);
strdup(buffer); // GOOD [FALSE POSITIVE]
}
{
char buffer[1024];
memset(buffer, 0, sizeof(buffer));
readlink(path, buffer, sizeof(buffer));
strdup(buffer); // BAD
}
{
char buffer[1024];
memset(buffer, 0, sizeof(buffer));
readlink(path, buffer, sizeof(buffer));
buffer[sizeof(buffer) - 1] = 0;
strdup(buffer); // GOOD
}
{
char *buffer = (char *)malloc(1024);
readlink(path, buffer, 1024);
strdup(buffer); // BAD
}
{
char *buffer = (char *)malloc(1024);
buffer[1023] = 0;
readlink(path, buffer, 1023);
strdup(buffer); // GOOD [FALSE POSITIVE]
}
{
char *buffer = (char *)malloc(sz);
readlink(path, buffer, sz);
strdup(buffer); // BAD
}
{
char *buffer = (char *)malloc(sz);
memset(buffer, 0, sz);
readlink(path, buffer, sz - 1);
strdup(buffer); // GOOD [FALSE POSITIVE]
}
}