hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Fixup queries which assumes that a guard is always an expression.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2025-09-17 16:45:50 +01:00
parent fbd877a118
commit 5e82eb9b24
5 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/src/Likely Bugs/Memory Management/NtohlArrayNoBound.qll
View File

@@ -136,7 +136,7 @@ private module NetworkToBufferSizeConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) { predicate isBarrier(DataFlow::Node node) {
exists(GuardCondition gc, GVN gvn | exists(GuardCondition gc, GVN gvn |
gc.getAChild*() = gvn.getAnExpr() and gc.(Expr).getAChild*() = gvn.getAnExpr() and
globalValueNumber(node.asExpr()) = gvn and globalValueNumber(node.asExpr()) = gvn and
gc.controls(node.asExpr().getBasicBlock(), _) gc.controls(node.asExpr().getBasicBlock(), _)
) )

2
cpp/ql/src/Security/CWE/CWE-295/SSLResultConflation.ql
View File

@@ -29,7 +29,7 @@ module VerifyResultConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) { source.asExpr() instanceof SslGetVerifyResultCall } predicate isSource(DataFlow::Node source) { source.asExpr() instanceof SslGetVerifyResultCall }
predicate isSink(DataFlow::Node sink) { predicate isSink(DataFlow::Node sink) {
exists(GuardCondition guard | guard.getAChild*() = sink.asExpr()) exists(GuardCondition guard | guard.(Expr).getAChild*() = sink.asExpr())
} }
predicate observeDiffInformedIncrementalMode() { any() } predicate observeDiffInformedIncrementalMode() { any() }

4
cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql
View File

@@ -115,7 +115,7 @@ predicate checksPath(Expr check, Expr checkPath) {
pragma[nomagic] pragma[nomagic]
predicate checkPathControlsUse(Expr check, Expr checkPath, Expr use) { predicate checkPathControlsUse(Expr check, Expr checkPath, Expr use) {
exists(GuardCondition guard | referenceTo(check, guard.getAChild*()) | exists(GuardCondition guard | referenceTo(check, guard.(Expr).getAChild*()) |
guard.controls(use.getBasicBlock(), _) guard.controls(use.getBasicBlock(), _)
) and ) and
checksPath(pragma[only_bind_into](check), checkPath) checksPath(pragma[only_bind_into](check), checkPath)
@@ -123,7 +123,7 @@ predicate checkPathControlsUse(Expr check, Expr checkPath, Expr use) {
pragma[nomagic] pragma[nomagic]
predicate fileNameOperationControlsUse(Expr check, Expr checkPath, Expr use) { predicate fileNameOperationControlsUse(Expr check, Expr checkPath, Expr use) {
exists(GuardCondition guard | referenceTo(check, guard.getAChild*()) | exists(GuardCondition guard | referenceTo(check, guard.(Expr).getAChild*()) |
guard.controls(use.getBasicBlock(), _) guard.controls(use.getBasicBlock(), _)
) and ) and
pragma[only_bind_into](check) = filenameOperation(checkPath) pragma[only_bind_into](check) = filenameOperation(checkPath)

2
cpp/ql/src/experimental/Security/CWE/CWE-401/MemoryLeakOnFailedCallToRealloc.ql
View File

@@ -51,7 +51,7 @@ class ReallocCallLeak extends FunctionCall {
predicate mayHandleByTermination() { predicate mayHandleByTermination() {
exists(GuardCondition guard, CallMayNotReturn exit | exists(GuardCondition guard, CallMayNotReturn exit |
this.(ControlFlowNode).getASuccessor*() = guard and this.(ControlFlowNode).getASuccessor*() = guard and
guard.getAChild*() = v.getAnAccess() and guard.(Expr).getAChild*() = v.getAnAccess() and
guard.controls(exit.getBasicBlock(), _) guard.controls(exit.getBasicBlock(), _)
) )
} }

2
cpp/ql/test/examples/docs-examples/analyzing-data-flow-in-cpp/index-flow-from-ntohl.ql
View File

@@ -22,7 +22,7 @@ module NetworkToBufferSizeConfig implements DataFlow::ConfigSig {
predicate isBarrier(DataFlow::Node node) { predicate isBarrier(DataFlow::Node node) {
exists(GuardCondition gc, Variable v | exists(GuardCondition gc, Variable v |
gc.getAChild*() = v.getAnAccess() and gc.(Expr).getAChild*() = v.getAnAccess() and
node.asExpr() = v.getAnAccess() and node.asExpr() = v.getAnAccess() and
gc.controls(node.asExpr().getBasicBlock(), _) and gc.controls(node.asExpr().getBasicBlock(), _) and
not exists(Loop loop | loop.getControllingExpr() = gc) not exists(Loop loop | loop.getControllingExpr() = gc)