hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 03:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

CPP: Equalize the definitions of 'baseType'.

Browse Source
This commit is contained in:
Geoffrey White
2019-04-05 11:28:11 +01:00
parent 373075e06d
commit 695df232e3
3 changed files with 29 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.ql
View File

@@ -14,12 +14,20 @@ import semmle.code.cpp.controlflow.SSA
import IncorrectPointerScalingCommon
private Type baseType(Type t) {
exists (DerivedType dt
| dt = t.getUnspecifiedType() and
isPointerType(dt) and
result = dt.getBaseType().getUnspecifiedType())
// Make sure that the type has a size and that it isn't ambiguous.
(
exists (PointerType dt
| dt = t.getUnspecifiedType() and
result = dt.getBaseType().getUnspecifiedType()) or
exists (ArrayType at
| at = t.getUnspecifiedType() and
(not at.getBaseType().getUnspecifiedType() instanceof ArrayType) and
result = at.getBaseType().getUnspecifiedType()) or
exists (ArrayType at, ArrayType at2
| at = t.getUnspecifiedType() and
at2 = at.getBaseType().getUnspecifiedType() and
result = baseType(at2))
)
// Make sure that the type has a size and that it isn't ambiguous.
and strictcount(result.getSize()) = 1
}

20
cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingVoid.ql
View File

@@ -14,12 +14,20 @@ import semmle.code.cpp.controlflow.SSA
import IncorrectPointerScalingCommon
private Type baseType(Type t) {
exists (DerivedType dt
| dt = t.getUnspecifiedType() and
isPointerType(dt) and
result = dt.getBaseType().getUnspecifiedType())
// Make sure that the type has a size and that it isn't ambiguous.
(
exists (PointerType dt
| dt = t.getUnspecifiedType() and
result = dt.getBaseType().getUnspecifiedType()) or
exists (ArrayType at
| at = t.getUnspecifiedType() and
(not at.getBaseType().getUnspecifiedType() instanceof ArrayType) and
result = at.getBaseType().getUnspecifiedType()) or
exists (ArrayType at, ArrayType at2
| at = t.getUnspecifiedType() and
at2 = at.getBaseType().getUnspecifiedType() and
result = baseType(at2))
)
// Make sure that the type has a size and that it isn't ambiguous.
and strictcount(result.getSize()) = 1
}

2
cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/IncorrectPointerScaling/IncorrectPointerScalingChar.expected
View File

@@ -1,4 +1,4 @@
| test.cpp:13:19:13:29 | charPointer | This pointer might have type $@ (size 4), but the pointer arithmetic here is done with type char * (size 1). | test.cpp:10:31:10:38 | test.cpp:10:31:10:38 | int |
| test.cpp:77:17:77:17 | x | This pointer might have type $@ (size 4), but the pointer arithmetic here is done with type char * (size 1). | test.cpp:72:19:72:19 | test.cpp:72:19:72:19 | int |
| test.cpp:119:26:119:26 | p | This pointer might have type $@ (size 8), but the pointer arithmetic here is done with type char * (size 1). | test.cpp:114:22:114:22 | test.cpp:114:22:114:22 | mystruct |
| test.cpp:147:19:147:29 | charPointer | This pointer might have type $@ (size 8), but the pointer arithmetic here is done with type char * (size 1). | test.cpp:145:31:145:38 | test.cpp:145:31:145:38 | int[2] |
| test.cpp:147:19:147:29 | charPointer | This pointer might have type $@ (size 4), but the pointer arithmetic here is done with type char * (size 1). | test.cpp:145:31:145:38 | test.cpp:145:31:145:38 | int |