hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 18:55:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add more test cases.

Browse Source
This commit is contained in:
Geoffrey White
2021-07-26 18:12:20 +01:00
parent 5d3e8d2add
commit 503c5c9e33
3 changed files with 140 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected
View File

@@ -7,6 +7,7 @@ edges
| test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r |
| test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r |
| test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r |
| test.c:125:13:125:16 | call to rand | test.c:127:9:127:9 | r |
| test.cpp:8:9:8:12 | Store | test.cpp:24:11:24:18 | call to get_rand |
| test.cpp:8:9:8:12 | call to rand | test.cpp:8:9:8:12 | Store |
| test.cpp:13:2:13:15 | Chi [[]] | test.cpp:30:13:30:14 | get_rand2 output argument [[]] |
@@ -18,6 +19,19 @@ edges
| test.cpp:30:13:30:14 | get_rand2 output argument [[]] | test.cpp:30:13:30:14 | Chi |
| test.cpp:36:13:36:13 | Chi | test.cpp:37:7:37:7 | r |
| test.cpp:36:13:36:13 | get_rand3 output argument [[]] | test.cpp:36:13:36:13 | Chi |
| test.cpp:54:10:54:13 | call to rand | test.cpp:57:9:57:9 | x |
| test.cpp:63:23:63:31 | buf_start | test.cpp:67:9:67:11 | len |
| test.cpp:63:40:63:46 | buf_end | test.cpp:67:9:67:11 | len |
| test.cpp:72:50:72:53 | call to rand | test.cpp:73:2:73:12 | ... + ... |
| test.cpp:72:50:72:53 | call to rand | test.cpp:73:2:73:12 | buf |
| test.cpp:73:2:73:12 | ... + ... | test.cpp:63:40:63:46 | buf_end |
| test.cpp:73:2:73:12 | buf | test.cpp:63:23:63:31 | buf_start |
| test.cpp:78:10:78:13 | call to rand | test.cpp:82:10:82:10 | x |
| test.cpp:78:10:78:13 | call to rand | test.cpp:84:10:84:10 | x |
| test.cpp:90:10:90:13 | call to rand | test.cpp:94:10:94:10 | x |
| test.cpp:90:10:90:13 | call to rand | test.cpp:97:9:97:9 | x |
| test.cpp:102:10:102:13 | call to rand | test.cpp:108:10:108:10 | y |
| test.cpp:116:10:116:13 | call to rand | test.cpp:124:9:124:9 | y |
nodes
| test.c:18:13:18:16 | call to rand | semmle.label | call to rand |
| test.c:21:17:21:17 | r | semmle.label | r |
@@ -33,6 +47,8 @@ nodes
| test.c:83:9:83:9 | r | semmle.label | r |
| test.c:99:14:99:19 | call to rand | semmle.label | call to rand |
| test.c:100:5:100:5 | r | semmle.label | r |
| test.c:125:13:125:16 | call to rand | semmle.label | call to rand |
| test.c:127:9:127:9 | r | semmle.label | r |
| test.cpp:8:9:8:12 | Store | semmle.label | Store |
| test.cpp:8:9:8:12 | call to rand | semmle.label | call to rand |
| test.cpp:13:2:13:15 | Chi [[]] | semmle.label | Chi [[]] |
@@ -47,6 +63,24 @@ nodes
| test.cpp:36:13:36:13 | Chi | semmle.label | Chi |
| test.cpp:36:13:36:13 | get_rand3 output argument [[]] | semmle.label | get_rand3 output argument [[]] |
| test.cpp:37:7:37:7 | r | semmle.label | r |
| test.cpp:54:10:54:13 | call to rand | semmle.label | call to rand |
| test.cpp:57:9:57:9 | x | semmle.label | x |
| test.cpp:63:23:63:31 | buf_start | semmle.label | buf_start |
| test.cpp:63:40:63:46 | buf_end | semmle.label | buf_end |
| test.cpp:67:9:67:11 | len | semmle.label | len |
| test.cpp:72:50:72:53 | call to rand | semmle.label | call to rand |
| test.cpp:73:2:73:12 | ... + ... | semmle.label | ... + ... |
| test.cpp:73:2:73:12 | buf | semmle.label | buf |
| test.cpp:78:10:78:13 | call to rand | semmle.label | call to rand |
| test.cpp:82:10:82:10 | x | semmle.label | x |
| test.cpp:84:10:84:10 | x | semmle.label | x |
| test.cpp:90:10:90:13 | call to rand | semmle.label | call to rand |
| test.cpp:94:10:94:10 | x | semmle.label | x |
| test.cpp:97:9:97:9 | x | semmle.label | x |
| test.cpp:102:10:102:13 | call to rand | semmle.label | call to rand |
| test.cpp:108:10:108:10 | y | semmle.label | y |
| test.cpp:116:10:116:13 | call to rand | semmle.label | call to rand |
| test.cpp:124:9:124:9 | y | semmle.label | y |
#select
| test.c:21:17:21:17 | r | test.c:18:13:18:16 | call to rand | test.c:21:17:21:17 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:18:13:18:16 | call to rand | Uncontrolled value |
| test.c:35:5:35:5 | r | test.c:34:13:34:18 | call to rand | test.c:35:5:35:5 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:34:13:34:18 | call to rand | Uncontrolled value |
@@ -56,6 +90,17 @@ nodes
| test.c:83:9:83:9 | r | test.c:81:14:81:17 | call to rand | test.c:83:9:83:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:81:14:81:17 | call to rand | Uncontrolled value |
| test.c:83:9:83:9 | r | test.c:81:23:81:26 | call to rand | test.c:83:9:83:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:81:23:81:26 | call to rand | Uncontrolled value |
| test.c:100:5:100:5 | r | test.c:99:14:99:19 | call to rand | test.c:100:5:100:5 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:99:14:99:19 | call to rand | Uncontrolled value |
| test.c:127:9:127:9 | r | test.c:125:13:125:16 | call to rand | test.c:127:9:127:9 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:125:13:125:16 | call to rand | Uncontrolled value |
| test.c:127:9:127:9 | r | test.c:125:13:125:16 | call to rand | test.c:127:9:127:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:125:13:125:16 | call to rand | Uncontrolled value |
| test.cpp:25:7:25:7 | r | test.cpp:8:9:8:12 | call to rand | test.cpp:25:7:25:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:8:9:8:12 | call to rand | Uncontrolled value |
| test.cpp:31:7:31:7 | r | test.cpp:13:10:13:13 | call to rand | test.cpp:31:7:31:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:13:10:13:13 | call to rand | Uncontrolled value |
| test.cpp:37:7:37:7 | r | test.cpp:18:9:18:12 | call to rand | test.cpp:37:7:37:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:18:9:18:12 | call to rand | Uncontrolled value |
| test.cpp:57:9:57:9 | x | test.cpp:54:10:54:13 | call to rand | test.cpp:57:9:57:9 | x | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:54:10:54:13 | call to rand | Uncontrolled value |
| test.cpp:67:9:67:11 | len | test.cpp:72:50:72:53 | call to rand | test.cpp:67:9:67:11 | len | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:72:50:72:53 | call to rand | Uncontrolled value |
| test.cpp:67:9:67:11 | len | test.cpp:72:50:72:53 | call to rand | test.cpp:67:9:67:11 | len | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:72:50:72:53 | call to rand | Uncontrolled value |
| test.cpp:82:10:82:10 | x | test.cpp:78:10:78:13 | call to rand | test.cpp:82:10:82:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:78:10:78:13 | call to rand | Uncontrolled value |
| test.cpp:84:10:84:10 | x | test.cpp:78:10:78:13 | call to rand | test.cpp:84:10:84:10 | x | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:78:10:78:13 | call to rand | Uncontrolled value |
| test.cpp:94:10:94:10 | x | test.cpp:90:10:90:13 | call to rand | test.cpp:94:10:94:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:90:10:90:13 | call to rand | Uncontrolled value |
| test.cpp:97:9:97:9 | x | test.cpp:90:10:90:13 | call to rand | test.cpp:97:9:97:9 | x | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:90:10:90:13 | call to rand | Uncontrolled value |
| test.cpp:108:10:108:10 | y | test.cpp:102:10:102:13 | call to rand | test.cpp:108:10:108:10 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:102:10:102:13 | call to rand | Uncontrolled value |
| test.cpp:124:9:124:9 | y | test.cpp:116:10:116:13 | call to rand | test.cpp:124:9:124:9 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.cpp:116:10:116:13 | call to rand | Uncontrolled value |

19
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/test.c
View File

@@ -119,3 +119,22 @@ void randomTester2(int bound, int min, int max) {
int r2 = (rand() % (max - min + 1)) + min;
r2 += 100; // GOOD (This is a common way to clamp the random value between [min, max])
}
void moreTests() {
{
int r = rand();
r = r * 100; // BAD
}
{
int r = rand();
r *= 100; // BAD [NOT DETECTED]
}
{
int r = rand();
r <<= 8; // BAD [NOT DETECTED]
}
}

77
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/test.cpp
View File

@@ -47,4 +47,79 @@ void test_with_bounded_randomness() {
unsigned unsigned_r = rand(10);
unsigned_r++; // GOOD
}
}
int test_remainder_subtract()
{
int x = rand();
int y = x % 100; // y <= x
return x - y; // GOOD (as y <= x) [FALSE POSITIVE]
}
typedef unsigned long size_t;
int snprintf(char *s, size_t n, const char *format, ...);
int test_buffer(char *buf_start, char *buf_end)
{
int len = buf_end - buf_start;
return len * 2; // GOOD [FALSE POSITIVE]
}
int test_snprintf(char *buf, size_t buf_sz)
{
snprintf(buf, buf_sz, "my random number: %i\n", rand());
test_buffer(buf, buf + buf_sz);
}
int test_else_1()
{
int x = rand();
if (x > 100)
{
return x * 10; // BAD
} else {
return x * 10; // GOOD (as x <= 100) [FALSE POSITIVE]
}
}
int test_else_2()
{
int x = rand();
if (x > 100)
{
return x * 10; // BAD
}
return x * 10; // GOOD (as x <= 100) [FALSE POSITIVE]
}
int test_conditional_assignment_1()
{
int x = rand();
int y = 100;
if (x < y)
{
y = x;
return y * 10; // GOOD (as y <= 100) [FALSE POSITIVE]
} else {
return y * 10; // GOOD (as y = 100)
}
}
int test_conditional_assignment_2()
{
int x = rand();
int y = 100;
if (x < y)
{
y = x;
}
return y * 10; // GOOD (as y <= 100) [FALSE POSITIVE]
}