mirror of
https://github.com/github/codeql.git
synced 2026-04-30 19:26:02 +02:00
C++: Remove all uses of hasQualifiedName/1
This commit is contained in:
@@ -13,7 +13,7 @@ import semmle.code.cpp.pointsto.PointsTo
|
||||
import Negativity
|
||||
|
||||
predicate closeCall(FunctionCall fc, Variable v) {
|
||||
fc.getTarget().hasQualifiedName("close") and v.getAnAccess() = fc.getArgument(0)
|
||||
fc.getTarget().hasGlobalName("close") and v.getAnAccess() = fc.getArgument(0)
|
||||
or
|
||||
exists(FunctionCall midcall, Function mid, int arg |
|
||||
fc.getArgument(arg) = v.getAnAccess() and
|
||||
|
||||
@@ -13,7 +13,7 @@ import semmle.code.cpp.pointsto.PointsTo
|
||||
|
||||
predicate closed(Expr e) {
|
||||
exists(FunctionCall fc |
|
||||
fc.getTarget().hasQualifiedName("close") and
|
||||
fc.getTarget().hasGlobalName("close") and
|
||||
fc.getArgument(0) = e
|
||||
)
|
||||
}
|
||||
|
||||
@@ -30,7 +30,7 @@ predicate useFunc(GlobalVariable v, Function f) {
|
||||
}
|
||||
|
||||
predicate uninitialisedBefore(GlobalVariable v, Function f) {
|
||||
f.hasQualifiedName("main")
|
||||
f.hasGlobalName("main")
|
||||
or
|
||||
exists(Call call, Function g |
|
||||
uninitialisedBefore(v, g) and
|
||||
|
||||
@@ -55,7 +55,7 @@ predicate allocCallOrIndirect(Expr e) {
|
||||
* can cause memory leaks.
|
||||
*/
|
||||
predicate verifiedRealloc(FunctionCall reallocCall, Variable v, ControlFlowNode verified) {
|
||||
reallocCall.getTarget().hasQualifiedName("realloc") and
|
||||
reallocCall.getTarget().hasGlobalName("realloc") and
|
||||
reallocCall.getArgument(0) = v.getAnAccess() and
|
||||
(
|
||||
exists(Variable newV, ControlFlowNode node |
|
||||
@@ -82,7 +82,7 @@ predicate verifiedRealloc(FunctionCall reallocCall, Variable v, ControlFlowNode
|
||||
predicate freeCallOrIndirect(ControlFlowNode n, Variable v) {
|
||||
// direct free call
|
||||
freeCall(n, v.getAnAccess()) and
|
||||
not n.(FunctionCall).getTarget().hasQualifiedName("realloc")
|
||||
not n.(FunctionCall).getTarget().hasGlobalName("realloc")
|
||||
or
|
||||
// verified realloc call
|
||||
verifiedRealloc(_, v, n)
|
||||
|
||||
@@ -14,8 +14,8 @@ import cpp
|
||||
|
||||
class MallocCall extends FunctionCall {
|
||||
MallocCall() {
|
||||
this.getTarget().hasQualifiedName("malloc") or
|
||||
this.getTarget().hasQualifiedName("std::malloc")
|
||||
this.getTarget().hasGlobalName("malloc") or
|
||||
this.getTarget().hasQualifiedName("std", "malloc")
|
||||
}
|
||||
|
||||
Expr getAllocatedSize() {
|
||||
@@ -36,12 +36,12 @@ predicate spaceProblem(FunctionCall append, string msg) {
|
||||
malloc.getAllocatedSize() = add and
|
||||
buffer.getAnAccess() = strlen.getStringExpr() and
|
||||
(
|
||||
insert.getTarget().hasQualifiedName("strcpy") or
|
||||
insert.getTarget().hasQualifiedName("strncpy")
|
||||
insert.getTarget().hasGlobalName("strcpy") or
|
||||
insert.getTarget().hasGlobalName("strncpy")
|
||||
) and
|
||||
(
|
||||
append.getTarget().hasQualifiedName("strcat") or
|
||||
append.getTarget().hasQualifiedName("strncat")
|
||||
append.getTarget().hasGlobalName("strcat") or
|
||||
append.getTarget().hasGlobalName("strncat")
|
||||
) and
|
||||
malloc.getASuccessor+() = insert and
|
||||
insert.getArgument(1) = buffer.getAnAccess() and
|
||||
|
||||
@@ -25,7 +25,7 @@ import semmle.code.cpp.security.TaintTracking
|
||||
predicate sourceSized(FunctionCall fc, Expr src) {
|
||||
exists(string name |
|
||||
(name = "strncpy" or name = "strncat" or name = "memcpy" or name = "memmove") and
|
||||
fc.getTarget().hasQualifiedName(name)
|
||||
fc.getTarget().hasGlobalName(name)
|
||||
) and
|
||||
exists(Expr dest, Expr size, Variable v |
|
||||
fc.getArgument(0) = dest and
|
||||
|
||||
@@ -59,21 +59,21 @@ predicate overflowOffsetInLoop(BufferAccess bufaccess, string msg) {
|
||||
}
|
||||
|
||||
predicate bufferAndSizeFunction(Function f, int buf, int size) {
|
||||
f.hasQualifiedName("read") and buf = 1 and size = 2
|
||||
f.hasGlobalName("read") and buf = 1 and size = 2
|
||||
or
|
||||
f.hasQualifiedName("fgets") and buf = 0 and size = 1
|
||||
f.hasGlobalName("fgets") and buf = 0 and size = 1
|
||||
or
|
||||
f.hasQualifiedName("strncpy") and buf = 0 and size = 2
|
||||
f.hasGlobalName("strncpy") and buf = 0 and size = 2
|
||||
or
|
||||
f.hasQualifiedName("strncat") and buf = 0 and size = 2
|
||||
f.hasGlobalName("strncat") and buf = 0 and size = 2
|
||||
or
|
||||
f.hasQualifiedName("memcpy") and buf = 0 and size = 2
|
||||
f.hasGlobalName("memcpy") and buf = 0 and size = 2
|
||||
or
|
||||
f.hasQualifiedName("memmove") and buf = 0 and size = 2
|
||||
f.hasGlobalName("memmove") and buf = 0 and size = 2
|
||||
or
|
||||
f.hasQualifiedName("snprintf") and buf = 0 and size = 1
|
||||
f.hasGlobalName("snprintf") and buf = 0 and size = 1
|
||||
or
|
||||
f.hasQualifiedName("vsnprintf") and buf = 0 and size = 1
|
||||
f.hasGlobalName("vsnprintf") and buf = 0 and size = 1
|
||||
}
|
||||
|
||||
class CallWithBufferSize extends FunctionCall {
|
||||
|
||||
@@ -16,7 +16,7 @@ import semmle.code.cpp.controlflow.LocalScopeVariableReachability
|
||||
predicate isFreeExpr(Expr e, LocalScopeVariable v) {
|
||||
exists(VariableAccess va | va.getTarget() = v |
|
||||
exists(FunctionCall fc | fc = e |
|
||||
fc.getTarget().hasQualifiedName("free") and
|
||||
fc.getTarget().hasGlobalName("free") and
|
||||
va = fc.getArgument(0)
|
||||
)
|
||||
or
|
||||
|
||||
Reference in New Issue
Block a user