hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Also exclude unevaluated buffers in 'OverflowStatic'.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-03-21 09:53:08 +00:00
parent 4d2a1ea149
commit 40cc2e7891
3 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
cpp/ql/src/Critical/OverflowStatic.ql
View File

@@ -22,7 +22,8 @@ import LoopBounds
private predicate staticBufferBase(VariableAccess access, Variable v) {
v.getType().(ArrayType).getBaseType() instanceof CharType and
access = v.getAnAccess() and
not memberMayBeVarSize(_, v)
not memberMayBeVarSize(_, v) and
not access.isUnevaluated()
}
predicate staticBuffer(VariableAccess access, Variable v, int size) {

1
cpp/ql/test/query-tests/Critical/OverflowStatic/OverflowStatic.expected
View File

@@ -14,4 +14,3 @@
| test.cpp:24:27:24:27 | 4 | Potential buffer-overflow: 'buffer1' has size 3 not 4. |
| test.cpp:26:27:26:27 | 4 | Potential buffer-overflow: 'buffer2' has size 3 not 4. |
| test.cpp:40:22:40:27 | amount | Potential buffer-overflow: 'buffer' has size 100 not 101. |
| test.cpp:62:33:62:43 | access to array | Potential buffer-overflow: 'buffer' has size 100 but 'buffer[101]' may be accessed here. |

2
cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp
View File

@@ -59,5 +59,5 @@ void f3() {
int unevaluated_test() {
char buffer[100];
return sizeof(buffer) / sizeof(buffer[101]); // GOOD [FALSE POSITIVE]
return sizeof(buffer) / sizeof(buffer[101]); // GOOD
}