hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 17:23:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add a test demonstrating the recent regression.

Browse Source
This commit is contained in:
Geoffrey White
2020-09-14 16:18:33 +01:00
parent 22097a9e13
commit 6ca9c449af
3 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected
View File

@@ -1,3 +1,5 @@
| test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
| test2.cpp:14:11:14:11 | v | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
| test3.c:15:10:15:10 | x | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |
| test3.c:15:14:15:14 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |
| test3.c:15:18:15:18 | z | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test3.c:11:15:11:18 | argv | User-provided value |

3
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/IntegerOverflowTainted.expected
View File

@@ -1,3 +1,6 @@
| test2.cpp:14:11:14:15 | ... * ... | $@ flows to here and is used in an expression which might overflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
| test2.cpp:16:11:16:21 | ... * ... | $@ flows to here and is used in an expression which might overflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
| test2.cpp:17:11:17:22 | ... * ... | $@ flows to here and is used in an expression which might overflow. | test2.cpp:25:22:25:23 | & ... | User-provided value |
| test3.c:12:31:12:34 | * ... | $@ flows to here and is used in an expression which might overflow negatively. | test3.c:11:15:11:18 | argv | User-provided value |
| test3.c:13:16:13:19 | * ... | $@ flows to here and is used in an expression which might overflow negatively. | test3.c:11:15:11:18 | argv | User-provided value |
| test4.cpp:13:17:13:20 | access to array | $@ flows to here and is used in an expression which might overflow negatively. | test4.cpp:9:13:9:16 | argv | User-provided value |

28
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/test2.cpp Normal file
View File

@@ -0,0 +1,28 @@
typedef signed long long int s64;
typedef struct {} FILE;
int fscanf(FILE *stream, const char *format, ...);
FILE *stdin;
typedef struct _myStruct {
s64 val;
} MyStruct;
void test2_sink(s64 v, MyStruct s, MyStruct &s_r, MyStruct *s_p)
{
s64 v1 = v * 2; // bad
s64 v2 = s.val * 2; // bad [NOT DETECTED]
s64 v3 = s_r.val * 2; // bad
s64 v4 = s_p->val * 2; // bad
}
void test2_source()
{
MyStruct ms;
s64 v;
fscanf(stdin, "%i", &v);
ms.val = v;
test2_sink(v, ms, ms, &ms);
}