hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #20400 from MathiasVP/cleanup-incorrect-scanf-query

Browse Source 
C++: Cleanup `ScanfChecks.qll`
This commit is contained in:
Mathias Vorreiter Pedersen
2025-09-10 16:31:49 +01:00
committed by GitHub
parent edec76ae10 72d7223fd0
commit 4227dd7d73
1 changed files with 14 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
cpp/ql/src/Critical/ScanfChecks.qll
View File

@@ -4,13 +4,9 @@ private import semmle.code.cpp.controlflow.IRGuards
private import semmle.code.cpp.ir.ValueNumbering private import semmle.code.cpp.ir.ValueNumbering
private predicate exprInBooleanContext(Expr e) { private predicate exprInBooleanContext(Expr e) {
exists(IRGuardCondition gc | exists(IRGuardCondition gc, Instruction i |
exists(Instruction i | i.getUnconvertedResultExpression() = e and
i.getUnconvertedResultExpression() = e and gc.comparesEq(valueNumber(i).getAUse(), 0, _, _)
gc.comparesEq(valueNumber(i).getAUse(), 0, _, _)
)
or
gc.getUnconvertedResultExpression() = e
) )
} }
@@ -36,20 +32,18 @@ private string getEofValue() {
* Holds if the value of `call` has been checked to not equal `EOF`. * Holds if the value of `call` has been checked to not equal `EOF`.
*/ */
private predicate checkedForEof(ScanfFunctionCall call) { private predicate checkedForEof(ScanfFunctionCall call) {
exists(IRGuardCondition gc | exists(IRGuardCondition gc, CallInstruction i | i.getUnconvertedResultExpression() = call |
exists(CallInstruction i | i.getUnconvertedResultExpression() = call | exists(int val | gc.comparesEq(valueNumber(i).getAUse(), val, _, _) |
exists(int val | gc.comparesEq(valueNumber(i).getAUse(), val, _, _) | // call == EOF
// call == EOF val = getEofValue().toInt()
val = getEofValue().toInt()
or
// call == [any positive number]
val > 0
)
or or
exists(int val | gc.comparesLt(valueNumber(i).getAUse(), val, true, _) | // call == [any positive number]
// call < [any non-negative number] (EOF is guaranteed to be negative) val > 0
val >= 0 )
) or
exists(int val | gc.comparesLt(valueNumber(i).getAUse(), val, true, _) |
// call < [any non-negative number] (EOF is guaranteed to be negative)
val >= 0
) )
) )
} }