hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Even more test cases.

Browse Source
This commit is contained in:
Geoffrey White
2025-02-20 18:06:47 +00:00
parent 3aa1ba5876
commit 547b082ac3
3 changed files with 34 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.expected
View File

@@ -100,6 +100,7 @@
| tests.cpp:938:2:938:17 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:906:11:906:12 | xs | array |
| tests.cpp:940:2:940:17 | access to array | This array indexing operation accesses byte offset 399 but the $@ is only 40 bytes. | tests.cpp:906:11:906:12 | xs | array |
| tests.cpp:941:2:941:18 | access to array | This array indexing operation accesses byte offset 403 but the $@ is only 40 bytes. | tests.cpp:906:11:906:12 | xs | array |
| tests.cpp:969:10:969:37 | access to array | This array indexing operation accesses byte offset 43 but the $@ is only 40 bytes. | tests.cpp:959:6:959:11 | values | array |
| tests_restrict.c:12:2:12:7 | call to memcpy | This 'memcpy' operation accesses 2 bytes but the $@ is only 1 byte. | tests_restrict.c:7:6:7:13 | smallbuf | source buffer |
| unions.cpp:26:2:26:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:21:10:21:11 | mu | destination buffer |
| unions.cpp:30:2:30:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |

24
cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected
View File

@@ -27,8 +27,8 @@ edges
| main.cpp:9:29:9:32 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | **argv | provenance | |
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | *argv | provenance | |
| main.cpp:10:20:10:23 | **argv | tests.cpp:958:32:958:35 | **argv | provenance | |
| main.cpp:10:20:10:23 | *argv | tests.cpp:958:32:958:35 | *argv | provenance | |
| main.cpp:10:20:10:23 | **argv | tests.cpp:978:32:978:35 | **argv | provenance | |
| main.cpp:10:20:10:23 | *argv | tests.cpp:978:32:978:35 | *argv | provenance | |
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | **argv | provenance | |
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | *argv | provenance | |
| test_buffer_overrun.cpp:32:46:32:49 | **argv | test_buffer_overrun.cpp:32:46:32:49 | **argv | provenance | |
@@ -41,12 +41,12 @@ edges
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:14:649:19 | *home | provenance | |
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:16:649:19 | *home | provenance | |
| tests.cpp:649:16:649:19 | *home | tests.cpp:649:14:649:19 | *home | provenance | |
| tests.cpp:958:32:958:35 | **argv | tests.cpp:983:9:983:15 | *access to array | provenance | |
| tests.cpp:958:32:958:35 | **argv | tests.cpp:984:9:984:15 | *access to array | provenance | |
| tests.cpp:958:32:958:35 | *argv | tests.cpp:983:9:983:15 | *access to array | provenance | |
| tests.cpp:958:32:958:35 | *argv | tests.cpp:984:9:984:15 | *access to array | provenance | |
| tests.cpp:983:9:983:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
| tests.cpp:984:9:984:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
| tests.cpp:978:32:978:35 | **argv | tests.cpp:1003:9:1003:15 | *access to array | provenance | |
| tests.cpp:978:32:978:35 | **argv | tests.cpp:1004:9:1004:15 | *access to array | provenance | |
| tests.cpp:978:32:978:35 | *argv | tests.cpp:1003:9:1003:15 | *access to array | provenance | |
| tests.cpp:978:32:978:35 | *argv | tests.cpp:1004:9:1004:15 | *access to array | provenance | |
| tests.cpp:1003:9:1003:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
| tests.cpp:1004:9:1004:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
| tests_restrict.c:15:41:15:44 | **argv | tests_restrict.c:15:41:15:44 | **argv | provenance | |
| tests_restrict.c:15:41:15:44 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
nodes
@@ -80,10 +80,10 @@ nodes
| tests.cpp:649:14:649:14 | *s [*home] | semmle.label | *s [*home] |
| tests.cpp:649:14:649:19 | *home | semmle.label | *home |
| tests.cpp:649:16:649:19 | *home | semmle.label | *home |
| tests.cpp:958:32:958:35 | **argv | semmle.label | **argv |
| tests.cpp:958:32:958:35 | *argv | semmle.label | *argv |
| tests.cpp:983:9:983:15 | *access to array | semmle.label | *access to array |
| tests.cpp:984:9:984:15 | *access to array | semmle.label | *access to array |
| tests.cpp:978:32:978:35 | **argv | semmle.label | **argv |
| tests.cpp:978:32:978:35 | *argv | semmle.label | *argv |
| tests.cpp:1003:9:1003:15 | *access to array | semmle.label | *access to array |
| tests.cpp:1004:9:1004:15 | *access to array | semmle.label | *access to array |
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
| tests_restrict.c:15:41:15:44 | *argv | semmle.label | *argv |

21
cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp
View File

@@ -955,6 +955,26 @@ void test26() {
zs[1][2] = 0; // BAD: overrun write [NOT DETECTED]
}
struct Array10 {
int values[10];
};
void test27(size_t s) {
Array10 arr;
if (s < sizeof(arr.values[10])) { // GOOD (harmless)
// ...
}
if (s < offsetof(Array10, values[10])) { // GOOD (harmless) [FALSE POSITIVE]
// ...
}
if (s < &(arr.values[10]) - &(arr.values[0])) { // GOOD (harmless)
// ...
}
}
int tests_main(int argc, char *argv[])
{
long long arr17[19];
@@ -983,6 +1003,7 @@ int tests_main(int argc, char *argv[])
test24(argv[0]);
test25(argv[0]);
test26();
test27(argc);
return 0;
}