hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 19:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Fix Code Scanning errors.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-07-18 16:27:27 +01:00
parent 4762e883fc
commit 576f021c25
4 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll
View File

@@ -2,7 +2,6 @@ private import cpp
private import semmle.code.cpp.ir.dataflow.internal.ProductFlow private import semmle.code.cpp.ir.dataflow.internal.ProductFlow
private import semmle.code.cpp.ir.ValueNumbering private import semmle.code.cpp.ir.ValueNumbering
private import semmle.code.cpp.controlflow.IRGuards private import semmle.code.cpp.controlflow.IRGuards
private import semmle.code.cpp.ir.IR
private import codeql.util.Unit private import codeql.util.Unit
private import RangeAnalysisUtil private import RangeAnalysisUtil

3
cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll
View File

@@ -2,7 +2,6 @@ private import cpp
private import semmle.code.cpp.dataflow.new.DataFlow private import semmle.code.cpp.dataflow.new.DataFlow
private import semmle.code.cpp.ir.ValueNumbering private import semmle.code.cpp.ir.ValueNumbering
private import semmle.code.cpp.controlflow.IRGuards private import semmle.code.cpp.controlflow.IRGuards
private import semmle.code.cpp.ir.IR
private import AllocationToInvalidPointer as AllocToInvalidPointer private import AllocationToInvalidPointer as AllocToInvalidPointer
private import RangeAnalysisUtil private import RangeAnalysisUtil
@@ -174,7 +173,7 @@ private predicate derefSinkToOperation(
* Holds if `allocation` is the result of an allocation that flows to the left-hand side of `pai`, and where * Holds if `allocation` is the result of an allocation that flows to the left-hand side of `pai`, and where
* the right-hand side of `pai` is an offset such that the result of `pai` points to an out-of-bounds pointer. * the right-hand side of `pai` is an offset such that the result of `pai` points to an out-of-bounds pointer.
* *
* Futhermore, `derefSource` is at least as large as `pai` and flows to `derefSink` before being dereferenced * Furthermore, `derefSource` is at least as large as `pai` and flows to `derefSink` before being dereferenced
* by `operation` (which is either a `StoreInstruction` or `LoadInstruction`). The result is that `operation` * by `operation` (which is either a `StoreInstruction` or `LoadInstruction`). The result is that `operation`
* dereferences a pointer that's "off by `delta`" number of elements. * dereferences a pointer that's "off by `delta`" number of elements.
*/ */

4
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/AllocationToInvalidPointer.ql
View File

@@ -8,8 +8,8 @@ module AllocationToInvalidPointerTest implements TestSig {
string getARelevantTag() { result = "alloc" } string getARelevantTag() { result = "alloc" }
predicate hasActualResult(Location location, string element, string tag, string value) { predicate hasActualResult(Location location, string element, string tag, string value) {
exists(DataFlow::Node allocation, PointerAddInstruction pai, DataFlow::Node sink1, int delta | exists(DataFlow::Node allocation, PointerAddInstruction pai, int delta |
pointerAddInstructionHasBounds(allocation, pai, sink1, delta) and pointerAddInstructionHasBounds(allocation, pai, _, delta) and
location = pai.getLocation() and location = pai.getLocation() and
element = pai.toString() and element = pai.toString() and
tag = "alloc" tag = "alloc"

6
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerToDereference.ql
View File

@@ -48,10 +48,10 @@ module InvalidPointerToDereferenceTest implements TestSig {
predicate hasActualResult(Location location, string element, string tag, string value) { predicate hasActualResult(Location location, string element, string tag, string value) {
exists( exists(
PointerArithmeticInstruction pai, DataFlow::Node derefSource, DataFlow::Node derefSink, DataFlow::Node derefSource, DataFlow::Node derefSink, DataFlow::Node operation, int delta,
DataFlow::Node operation, int delta, string value1, string value2 string value1, string value2
| |
operationIsOffBy(_, pai, derefSource, derefSink, _, operation, delta) and operationIsOffBy(_, _, derefSource, derefSink, _, operation, delta) and
location = operation.getLocation() and location = operation.getLocation() and
element = operation.toString() and element = operation.toString() and
tag = "deref" and tag = "deref" and