hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 10:45:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #492 from geoffw0/offsetuse

Browse Source 
Approved by dave-bartolomeo
This commit is contained in:
semmle-qlci
2018-11-21 17:26:48 +00:00
committed by GitHub
parent 4e72a08b8d 646bb01a5f
commit 62db19bee7
5 changed files with 84 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
cpp/ql/src/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql
View File

@@ -5,6 +5,7 @@
* @kind problem
* @id cpp/offset-use-before-range-check
* @problem.severity warning
* @precision medium
* @tags reliability
* security
* external/cwe/cwe-120
@@ -13,10 +14,29 @@
import cpp
from Variable v, LogicalAndExpr andexpr, ArrayExpr access, LTExpr rangecheck
where access.getArrayOffset() = v.getAnAccess()
and andexpr.getLeftOperand().getAChild() = access
and andexpr.getRightOperand() = rangecheck
and rangecheck.getLeftOperand() = v.getAnAccess()
and not access.isInMacroExpansion()
predicate beforeArrayAccess(Variable v, ArrayExpr access, Expr before) {
exists(LogicalAndExpr andexpr |
access.getArrayOffset() = v.getAnAccess() and
andexpr.getRightOperand().getAChild*() = access and
andexpr.getLeftOperand() = before
)
}
predicate afterArrayAccess(Variable v, ArrayExpr access, Expr after) {
exists(LogicalAndExpr andexpr |
access.getArrayOffset() = v.getAnAccess() and
andexpr.getLeftOperand().getAChild*() = access and
andexpr.getRightOperand() = after
)
}
from Variable v, ArrayExpr access, LTExpr rangecheck
where
afterArrayAccess(v, access, rangecheck) and
rangecheck.getLeftOperand() = v.getAnAccess() and
not access.isInMacroExpansion() and
not exists(LTExpr altcheck |
beforeArrayAccess(v, access, altcheck) and
altcheck.getLeftOperand() = v.getAnAccess()
)
select access, "This use of offset '" + v.getName() + "' should follow the $@.", rangecheck, "range check"