hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

CPP: Fix in dataflow.

Browse Source
This commit is contained in:
Geoffrey White
2019-06-06 18:22:36 +01:00
parent d51f870053
commit 3deff9c578
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll
View File

@@ -75,7 +75,11 @@ predicate moveToDependingOnSide(Expr src, Expr dest) {
and (base = binop.getLeftOperand() or base = binop.getRightOperand()) and (base = binop.getLeftOperand() or base = binop.getRightOperand())
and isPointer(base.getType()) and isPointer(base.getType())
and base.getTarget() instanceof LocalScopeVariable and base.getTarget() instanceof LocalScopeVariable
and src = base) and src = base
// flow through pointer-pointer subtraction is dubious, the result should be
// a number bounded by the size of the pointed-to thing.
and not binop instanceof PointerDiffExpr)
or exists (UnaryOperation unop | or exists (UnaryOperation unop |
dest = unop dest = unop
and unop.getAnOperand() = src) and unop.getAnOperand() = src)

1
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
View File

@@ -4,4 +4,3 @@
| test.cpp:49:17:49:30 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | | test.cpp:49:17:49:30 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
| test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | | test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
| test.cpp:55:11:55:24 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | | test.cpp:55:11:55:24 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
| test.cpp:79:9:79:29 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:97:18:97:23 | buffer | user input (fread) |

2
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
View File

@@ -76,7 +76,7 @@ void processData2(char *start, char *end)
{ {
char *copy; char *copy;
copy = new char[end - start]; // GOOD [FALSE POSITIVE] copy = new char[end - start]; // GOOD
// ... // ...