hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-09 13:35:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add MISSING: tag

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-07-07 10:59:21 +01:00
parent 843ac7c6b0
commit 76d8ae8694
87 changed files with 284 additions and 284 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/test/examples/BadLocking/UnintendedDeclaration.cpp
View File

@@ -86,7 +86,7 @@ public:
void test7()
{
Lock<Mutex>(memberMutex); // BAD (creates an uninitialized variable called `memberMutex`, probably not intended) [NOT DETECTED]
Lock<Mutex>(memberMutex); // $ MISSING: Alert // BAD (creates an uninitialized variable called `memberMutex`, probably not intended) [NOT DETECTED]
// ...
}

6
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp
View File

@@ -19,7 +19,7 @@ void test1(int p)
{
sys_somesystemcall(&p);
unsafe_put_user(123, &p); // BAD [NOT DETECTED]
unsafe_put_user(123, &p); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test2(int p)
@@ -40,7 +40,7 @@ void test3()
sys_somesystemcall(&v);
unsafe_put_user(123, &v); // BAD [NOT DETECTED]
unsafe_put_user(123, &v); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test4()
@@ -68,7 +68,7 @@ void test5()
sys_somesystemcall(&myData);
unsafe_put_user(123, &(myData.x)); // BAD [NOT DETECTED]
unsafe_put_user(123, &(myData.x)); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test6()

2
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/test.cpp
View File

@@ -24,7 +24,7 @@ void test()
size_t size2 = x;
size2 *= y;
char *buffer6 = (char *)malloc(size2); // BAD [NOT DETECTED]
char *buffer6 = (char *)malloc(size2); // $ MISSING: Alert // $ MISSING: Alert // BAD [NOT DETECTED]
char *buffer7 = new char[x * 10]; // GOOD
char *buffer8 = new char[x * y]; // $ Alert // BAD

2
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp
View File

@@ -105,6 +105,6 @@ void test7(int size) {
}
for (char *p = arr; p <= arr + size; p++) {
*p = 0; // BAD [NOT DETECTED]
*p = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
}
}

4
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-200/test3/test.cpp
View File

@@ -10,8 +10,8 @@ int main(int argc, char *argv[])
{
FILE *fp;
char buf[128];
fp = fopen("myFile.txt","r+"); // BAD [NOT DETECTED]
fgets(buf,128,fp);
fp = fopen("myFile.txt","r+"); // $ MISSING: Alert // BAD [NOT DETECTED]
fgets(buf,128,fp);
fprintf(fp,"%s\n","data to file");
fclose(fp);
return 0;

10
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-369/semmle/tests/test.cpp
View File

@@ -58,9 +58,9 @@ int badTestf3(int type, int met) {
is = getSize(type);
switch (met) {
case 1:
if (is >= 0) return 123 / is; // BAD [NOT DETECTED]
if (is >= 0) return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
case 2:
if (0 == is) return 123 / is; // BAD [NOT DETECTED]
if (0 == is) return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
case 3:
if (!is & 123 / is) // $ Alert // BAD
return 123;
@@ -82,7 +82,7 @@ int badTestf3(int type, int met) {
}
if (is != 0) return -1;
if (is == 0) type += 1;
return 123 / is; // BAD [NOT DETECTED]
return 123 / is; // $ MISSING: Alert // BAD [NOT DETECTED]
}
int goodTestf3(int type, int met) {
@@ -223,7 +223,7 @@ int badTestf12(FILE * f) {
int a;
int ret = -1;
a = getc(f);
if (a == 0) ret = 123 / a; // BAD [NOT DETECTED]
if (a == 0) ret = 123 / a; // $ MISSING: Alert // BAD [NOT DETECTED]
return ret;
}
@@ -262,7 +262,7 @@ void badTestf13(int type) {
if (is < 5)
badMySubDiv(type, is); // $ Alert // BAD
if (is < 0)
badMySubDiv(type, is); // BAD [NOT DETECTED]
badMySubDiv(type, is); // $ MISSING: Alert // BAD [NOT DETECTED]
if (is > 5)
badMySubDiv(type, is); // GOOD
if (is == 0)

2
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-377/semmle/tests/test.cpp
View File

@@ -39,7 +39,7 @@ int funcTest3()
FILE *fp;
char filename[80];
strcat(filename, "/tmp/tmp.name");
fp = fopen(filename,"w"); // BAD [NOT DETECTED]
fp = fopen(filename,"w"); // $ MISSING: Alert // BAD [NOT DETECTED]
fprintf(fp,"%s\n","data to file");
fclose(fp);
return 0;

2
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp
View File

@@ -60,7 +60,7 @@ int functionWork1b(int retIndex) {
}
int functionWork1_() {
int i;
scanf("%i",&i); // BAD [NOT DETECTED]
scanf("%i",&i); // $ MISSING: Alert // BAD [NOT DETECTED]
if(i<10)
return -1;
return i;

4
cpp/ql/test/query-tests/Best Practices/GuardedFree/test.cpp
View File

@@ -52,7 +52,7 @@ void test6(char *x) {
}
void test7(char *x) {
if (x || x) { // BAD [NOT DETECTED]
if (x || x) { // $ MISSING: Alert // BAD [NOT DETECTED]
free(x);
}
}
@@ -91,7 +91,7 @@ void test10(char *x) {
if (x) free(x);
void test11(char *x) {
TRY_FREE(x) // BAD [NOT DETECTED]
TRY_FREE(x) // $ MISSING: Alert // BAD [NOT DETECTED]
}
bool test12(char *x) {

12
cpp/ql/test/query-tests/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck/test.cpp
View File

@@ -15,24 +15,24 @@ void test(char *buffer, int bufferSize)
if ((buffer[i] == 'x') && (i < bufferSize)) {} // $ Alert // BAD
if ((bufferSize > i) && (buffer[i] == 'x')) {} // GOOD
if ((buffer[i] == 'x') && (bufferSize > i)) {} // BAD [NOT DETECTED]
if ((buffer[i] == 'x') && (bufferSize > i)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
if ((i <= bufferSize - 1) && (buffer[i] == 'x')) {} // GOOD
if ((buffer[i] == 'x') && (i <= bufferSize - 1)) {} // BAD [NOT DETECTED]
if ((buffer[i] == 'x') && (i <= bufferSize - 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
if ((bufferSize >= i + 1) && (buffer[i] == 'x')) {} // GOOD
if ((buffer[i] == 'x') && (bufferSize >= i + 1)) {} // BAD [NOT DETECTED]
if ((buffer[i] == 'x') && (bufferSize >= i + 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
if ((i < bufferSize) && (true) && (buffer[i] == 'x')) {} // GOOD
if ((buffer[i] == 'x') && (true) && (i < bufferSize)) {} // $ Alert // BAD
if ((i < bufferSize - 1) && (buffer[i + 1] == 'x')) {} // GOOD
if ((buffer[i + 1] == 'x') && (i < bufferSize - 1)) {} // BAD [NOT DETECTED]
if ((buffer[i + 1] == 'x') && (i < bufferSize - 1)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
if ((i < bufferSize) && (buffer[i] == 'x') && (i < bufferSize - 1)) {} // GOOD
if ((i < bufferSize) && ((buffer[i] == 'x') && (i < bufferSize - 1))) {} // GOOD
if ((i < bufferSize + 1) && (buffer[i] == 'x') && (i < bufferSize)) {} // BAD [NOT DETECTED]
if ((i < bufferSize + 1) && ((buffer[i] == 'x') && (i < bufferSize))) {} // BAD [NOT DETECTED]
if ((i < bufferSize + 1) && (buffer[i] == 'x') && (i < bufferSize)) {} // $ MISSING: Alert // BAD [NOT DETECTED]
if ((i < bufferSize + 1) && ((buffer[i] == 'x') && (i < bufferSize))) {} // $ MISSING: Alert // BAD [NOT DETECTED]
// look for 'ab'
for (i = 0; i < bufferSize; i++) {

2
cpp/ql/test/query-tests/Best Practices/Unused Entities/UnusedStaticFunctions/extraction_error.c
View File

@@ -2,7 +2,7 @@
static void my_function1_called() {} // GOOD
static void my_function2_called_after_error() {} // GOOD
static void my_function3_not_called() {} // BAD [NOT DETECTED]
static void my_function3_not_called() {} // $ MISSING: Alert // BAD [NOT DETECTED]
int main(void) {
my_function1_called();

4
cpp/ql/test/query-tests/Critical/MemoryFreed/test.cpp
View File

@@ -182,7 +182,7 @@ void test_strdupa_no_dealloc() {
void test_strdupa_dealloc() {
char msg[] = "OctoCat";
char *cpy = strdupa(msg);
free(cpy); // BAD [NOT DETECTED]
free(cpy); // $ MISSING: Alert // BAD [NOT DETECTED]
}
// --- strndupa ---
@@ -196,7 +196,7 @@ void test_strndupa_no_dealloc() {
void test_strndupa_dealloc() {
char msg[] = "OctoCat";
char *cpy = strndupa(msg, 4);
free(cpy); // BAD [NOT DETECTED]
free(cpy); // $ MISSING: Alert // BAD [NOT DETECTED]
}
// ---

12
cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp
View File

@@ -23,7 +23,7 @@ void test_double_free_aliasing(void *a, void* b) {
free(a); // GOOD
a = b;
free(a); // GOOD
free(b); // BAD [NOT DETECTED]
free(b); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test_dominance1(void *a) {
@@ -40,8 +40,8 @@ void test_dominance2(void *a) {
void test_post_dominance1(int *a)
{
if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free]
if (condition()) a[2] = 5; // BAD [NOT DETECTED]
if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // BAD [NOT DETECTED]
if (condition()) a[2] = 5; // $ MISSING: Alert // BAD [NOT DETECTED]
if (condition()) free(a); // $ Source[cpp/double-free] Source[cpp/use-after-free] // $ MISSING: Alert // BAD [NOT DETECTED]
a[2] = 5; // $ Alert[cpp/use-after-free] // BAD
free(a); // $ Alert[cpp/double-free] // BAD
}
@@ -61,7 +61,7 @@ void test_use_after_free6(int *a, int *b) {
free(a);
a=b;
free(b);
if (condition()) a[0] = 5; // BAD [NOT DETECTED]
if (condition()) a[0] = 5; // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test_use_after_free7(int *a) {
@@ -343,7 +343,7 @@ void test_array(PtrContainer *containers) {
delete containers[0].ptr; // GOOD
delete containers[1].ptr; // GOOD
delete containers[2].ptr; // GOOD
delete containers[2].ptr; // BAD (double free) [NOT DETECTED]
delete containers[2].ptr; // $ MISSING: Alert // BAD (double free) [NOT DETECTED]
}
struct E {
@@ -424,5 +424,5 @@ void testHasGetter() {
free(buffer2);
HasGetterNoFree hg3;
void *buffer3 = hg3.getBuffer(); // BAD (not freed) [NOT DETECTED]
void *buffer3 = hg3.getBuffer(); // $ MISSING: Alert // BAD (not freed) [NOT DETECTED]
}

6
cpp/ql/test/query-tests/Critical/MissingCheckScanf/test.cpp
View File

@@ -299,7 +299,7 @@ int main()
int *ptr_i = &i;
scanf("%d", &i);
use(*ptr_i); // BAD [NOT DETECTED]: may not have written `i`
use(*ptr_i); // $ MISSING: Alert // BAD [NOT DETECTED]: may not have written `i`
}
{
@@ -307,7 +307,7 @@ int main()
int *ptr_i = &i;
scanf("%d", ptr_i);
use(i); // BAD [NOT DETECTED]: may not have written `*ptr_i`
use(i); // $ MISSING: Alert // BAD [NOT DETECTED]: may not have written `*ptr_i`
}
{
@@ -380,7 +380,7 @@ void my_scan_int_test()
use(i); // GOOD: used before scanf
my_scan_int(i);
use(i); // BAD [NOT DETECTED]
use(i); // $ MISSING: Alert // BAD [NOT DETECTED]
if (my_scan_int(i))
{

4
cpp/ql/test/query-tests/Critical/MissingNullTest/test.cpp
View File

@@ -18,13 +18,13 @@ void test1(bool cond)
{
int *p, *q;
y = *p; // BAD (p is uninitialized and could be 0) [NOT DETECTED]
y = *p; // $ MISSING: Alert // BAD (p is uninitialized and could be 0) [NOT DETECTED]
p = NULL;
y = *p; // $ Alert // BAD (p is 0)
p = &x;
y = *p; // GOOD (p points to x)
p = q;
y = *p; // BAD (p is uninitialized and could be 0) [NOT DETECTED]
y = *p; // $ MISSING: Alert // BAD (p is uninitialized and could be 0) [NOT DETECTED]
}
{

2
cpp/ql/test/query-tests/Critical/NewFree/test.cpp
View File

@@ -190,7 +190,7 @@ void test6(bool do_array_delete)
if (do_array_delete)
{
delete [] c_ptr_array[5]; // BAD [NOT DETECTED]
delete [] c_ptr_array[5]; // $ MISSING: Alert // BAD [NOT DETECTED]
} else {
delete c_ptr_array[5]; // GOOD
}

12
cpp/ql/test/query-tests/Critical/OverflowCalculated/tests1.cpp
View File

@@ -43,7 +43,7 @@ void tests1(int case_num)
break;
case 5:
buffer = (char *)calloc(strlen(str), sizeof(char)); // BAD [NOT DETECTED]
buffer = (char *)calloc(strlen(str), sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED]
strcpy(buffer, str);
break;
@@ -81,7 +81,7 @@ void tests1(int case_num)
break;
case 12:
buffer = (char *)malloc(strlen(str) + 0); // BAD [NOT DETECTED]
buffer = (char *)malloc(strlen(str) + 0); // $ MISSING: Alert // BAD [NOT DETECTED]
strcpy(buffer, str);
break;
@@ -91,17 +91,17 @@ void tests1(int case_num)
break;
case 102:
wbuffer = (wchar_t *)malloc(wcslen(wstr) + 1); // BAD (no sizeof) [NOT DETECTED]
wbuffer = (wchar_t *)malloc(wcslen(wstr) + 1); // $ MISSING: Alert // BAD (no sizeof) [NOT DETECTED]
wcscpy(wbuffer, wstr);
break;
case 103:
wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(char)); // BAD [NOT DETECTED]
wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED]
wcscpy(wbuffer, wstr);
break;
case 104:
wbuffer = (wchar_t *)calloc(wcslen(wstr) + 1, sizeof(char)); // BAD (wrong sizeof) [NOT DETECTED]
wbuffer = (wchar_t *)calloc(wcslen(wstr) + 1, sizeof(char)); // $ MISSING: Alert // BAD (wrong sizeof) [NOT DETECTED]
wcscpy(wbuffer, wstr);
break;
@@ -116,7 +116,7 @@ void tests1(int case_num)
break;
case 107:
wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(wchar_t)); // BAD [NOT DETECTED]
wbuffer = (wchar_t *)calloc(wcslen(wstr), sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED]
wcscpy(wbuffer, wstr);
break;

16
cpp/ql/test/query-tests/Critical/OverflowCalculated/tests2.cpp
View File

@@ -35,7 +35,7 @@ void tests2(int case_num)
break;
case 2:
buffer = (char *)malloc(strlen(str1) + strlen(str2)); // BAD [NOT DETECTED]
buffer = (char *)malloc(strlen(str1) + strlen(str2)); // $ MISSING: Alert // BAD [NOT DETECTED]
strcpy(buffer, str1);
strcat(buffer, str2);
break;
@@ -53,7 +53,7 @@ void tests2(int case_num)
break;
case 5:
buffer = (char *)malloc((strlen(str1) + strlen(str2)) * sizeof(char)); // BAD [NOT DETECTED]
buffer = (char *)malloc((strlen(str1) + strlen(str2)) * sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED]
strcpy(buffer, str1);
strcat(buffer, str2);
break;
@@ -65,7 +65,7 @@ void tests2(int case_num)
break;
case 7:
buffer = (char *)malloc((strlen(str1) + strlen(str2) + 1) * sizeof(char)); // BAD [NOT DETECTED]
buffer = (char *)malloc((strlen(str1) + strlen(str2) + 1) * sizeof(char)); // $ MISSING: Alert // BAD [NOT DETECTED]
strcpy(buffer, str1);
strcat(buffer, str2);
strcat(buffer, str3);
@@ -79,24 +79,24 @@ void tests2(int case_num)
break;
case 101:
wbuffer = (wchar_t *)malloc((wcslen(wstr1) + 1) * sizeof(wchar_t)); // BAD [NOT DETECTED]
wbuffer = (wchar_t *)malloc((wcslen(wstr1) + 1) * sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED]
wcscpy(wbuffer, wstr1);
wcscat(wbuffer, wstr2);
break;
case 102:
wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2)) * sizeof(wchar_t)); // BAD [NOT DETECTED]
wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2)) * sizeof(wchar_t)); // $ MISSING: Alert // BAD [NOT DETECTED]
wcscpy(wbuffer, wstr1);
wcscat(wbuffer, wstr2);
break;
case 103:
wbuffer = (wchar_t *)malloc((wcslen(wstr1) + wcslen(wstr2) + 1) * sizeof(wchar_t)); // GOOD
wcscpy(wbuffer, wstr1);
wcscat(wbuffer, wstr2);
break;
}
if (buffer != 0)
{
free(buffer);

2
cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp
View File

@@ -59,7 +59,7 @@ void test3b()
void test3c()
{
char *buffer = new char[10]; // BAD [NOT DETECTED]
char *buffer = new char[10]; // $ MISSING: Alert // BAD [NOT DETECTED]
strcpy(buffer, "123456");
strcat(buffer, "123456");

16
cpp/ql/test/query-tests/Critical/OverflowStatic/test.c
View File

@@ -8,19 +8,19 @@ struct {
void f(void) {
char c;
c = xs[-1]; // BAD [NOT DETECTED]
c = xs[-1]; // $ MISSING: Alert // BAD [NOT DETECTED]
c = xs[0]; // GOOD
c = xs[4]; // GOOD
c = xs[5]; // $ Alert // BAD
c = xs[6]; // $ Alert // BAD
c = stru.ys[-1]; // BAD [NOT DETECTED]
c = stru.ys[-1]; // $ MISSING: Alert // BAD [NOT DETECTED]
c = stru.ys[0]; // GOOD
c = stru.ys[4]; // GOOD
c = stru.ys[5]; // $ Alert // BAD
c = stru.ys[6]; // $ Alert // BAD
c = stru.zs[-1]; // BAD [NOT DETECTED]
c = stru.zs[-1]; // $ MISSING: Alert // BAD [NOT DETECTED]
c = stru.zs[0]; // GOOD (zs is variable size)
c = stru.zs[4]; // GOOD (zs is variable size)
c = stru.zs[5]; // GOOD (zs is variable size)
@@ -32,7 +32,7 @@ void test_buffer_sentinal() {
struct { char len; char buf[1]; } *b = malloc(10); // len(buf.buffer) effectively 8
b->buf[0] = 0; // GOOD
b->buf[7] = 0; // GOOD
b->buf[8] = 0; // BAD [NOT DETECTED]
b->buf[8] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
}
union u {
@@ -44,21 +44,21 @@ void union_test() {
union u u;
u.ptr[0] = 0; // GOOD
u.ptr[sizeof(u)-1] = 0; // GOOD
u.ptr[sizeof(u)] = 0; // BAD [NOT DETECTED]
u.ptr[sizeof(u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test_struct_union() {
struct { union u u; } v;
v.u.ptr[0] = 0; // GOOD
v.u.ptr[sizeof(union u)-1] = 0; // GOOD
v.u.ptr[sizeof(union u)] = 0; // BAD [NOT DETECTED]
v.u.ptr[sizeof(union u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
}
void union_test2() {
union { char ptr[1]; unsigned long value; } u;
u.ptr[0] = 0; // GOOD
u.ptr[sizeof(u)-1] = 0; // GOOD
u.ptr[sizeof(u)] = 0; // BAD [NOT DETECTED]
u.ptr[sizeof(u)] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
}
typedef struct {
@@ -69,5 +69,5 @@ typedef struct {
void test_alloc() {
// Special case of taking sizeof without any addition or multiplications
var_buf *b = malloc(sizeof(var_buf));
b->buf[1] = 0; // BAD [NOT DETECTED]
b->buf[1] = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
}

8
cpp/ql/test/query-tests/Critical/OverflowStatic/test.cpp
View File

@@ -35,16 +35,16 @@ void f2(char *src)
amount = 100;
memcpy(buffer, src, amount); // GOOD
amount = amount + 1;
memcpy(buffer, src, amount); // BAD [NOT DETECTED]
memcpy(buffer, src, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
amount = 101;
memcpy(buffer, src, amount); // $ Alert // BAD
ptr = buffer;
memcpy(ptr, src, 101); // BAD [NOT DETECTED]
memcpy(ptr, src, 101); // $ MISSING: Alert // BAD [NOT DETECTED]
ptr = &(buffer[0]);
memcpy(ptr, src, 101); // BAD [NOT DETECTED]
memcpy(ptr, src, 101); // $ MISSING: Alert // BAD [NOT DETECTED]
ptr = &(buffer[1]);
memcpy(ptr, src, 100); // BAD [NOT DETECTED]
memcpy(ptr, src, 100); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void f3() {

4
cpp/ql/test/query-tests/Critical/SizeCheck/test2.c
View File

@@ -50,8 +50,8 @@ void *MyMalloc2(size_t size);
void customAllocatorTests()
{
double *dptr1 = MyMalloc1(33); // BAD -- Not a multiple of sizeof(double) [NOT DETECTED]
double *dptr2 = MyMalloc2(33); // BAD -- Not a multiple of sizeof(double) [NOT DETECTED]
double *dptr1 = MyMalloc1(33); // $ MISSING: Alert // BAD -- Not a multiple of sizeof(double) [NOT DETECTED]
double *dptr2 = MyMalloc2(33); // $ MISSING: Alert // BAD -- Not a multiple of sizeof(double) [NOT DETECTED]
}
// --- variable length data structures ---

4
cpp/ql/test/query-tests/JPL_C/LOC-4/Rule 30/FunctionPointerConversions/test.c
View File

@@ -20,8 +20,8 @@ void test()
funPtr1 = funPtr2; // GOOD
funPtr2 = funPtr2; // GOOD
intPtr = funPtr2; // BAD (function pointer -> int pointer) [NOT DETECTED]
voidPtr = funPtr2; // BAD (function pointer -> void pointer) [NOT DETECTED]
intPtr = funPtr2; // $ MISSING: Alert // BAD (function pointer -> int pointer) [NOT DETECTED]
voidPtr = funPtr2; // $ MISSING: Alert // BAD (function pointer -> void pointer) [NOT DETECTED]
i = funPtr2; // GOOD (permitted)
funPtr1 = (void (*)())funPtr1; // GOOD

2
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp
View File

@@ -13,7 +13,7 @@ bool compareValues() {
// instantiations outside.
return
T1::value < T2::value || // GOOD
T1::value < T1::value || // BAD [NOT DETECTED]
T1::value < T1::value || // $ MISSING: Alert // BAD [NOT DETECTED]
C1::value < C1::value ; // $ Alert[cpp/comparison-of-identical-expressions] // BAD
}

2
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BitwiseSignCheck/bsc.cpp
View File

@@ -39,5 +39,5 @@ bool is_bit_set_v3(int x, int bitnum) {
}
bool is_bit_set_v4(int x, int bitnum) {
return (x & (1 << bitnum)) >= 1; // BAD [NOT DETECTED]
return (x & (1 << bitnum)) >= 1; // $ MISSING: Alert // BAD [NOT DETECTED]
}

2
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/ComparisonPrecedence/test.cpp
View File

@@ -57,7 +57,7 @@ void test1(int x, int y, int z) {
{
MyClass1 a, b, c;
if (a < b < c) {} // BAD (the overloaded `operator<` behaves like `<`) [NOT DETECTED]
if (a < b < c) {} // $ MISSING: Alert // BAD (the overloaded `operator<` behaves like `<`) [NOT DETECTED]
}
// overloaded non-comparison

4
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/Buildless.c
View File

@@ -8,7 +8,7 @@ void test_float_double1(float f, double d) {
float f1 = fabsf(f * f); // GOOD
float f2 = fabsf(f * d); // GOOD
double f3 = fabs(f * f); // BAD [NOT DETECTED]
double f3 = fabs(f * f); // $ MISSING: Alert // BAD [NOT DETECTED]
double f4 = fabs(f * d); // GOOD
}
@@ -23,6 +23,6 @@ void test_float_double2(float f, double d) {
float f1 = fabsf(f * f); // GOOD
float f2 = fabsf(f * d); // GOOD
double f3 = fabs(f * f); // BAD [NOT DETECTED]
double f3 = fabs(f * f); // $ MISSING: Alert // BAD [NOT DETECTED]
double f4 = fabs(f * d); // GOOD
}

6
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/IntMultToLong/IntMultToLong.c
View File

@@ -102,9 +102,9 @@ void g(unsigned char uchar1, unsigned char uchar2, unsigned char uchar3, int i)
ulong4 = (uchar1 + (uchar1 + 1)) * (uchar2 + 1); // GOOD
ulong5 = (i + (uchar1 + 1)) * (uchar2 + 1); // $ Alert // BAD
ulong5 = (uchar1 + 1073741824) * uchar2; // BAD [NOT DETECTED]
ulong5 = (uchar1 + (1 << 30)) * uchar2; // BAD [NOT DETECTED]
ulong5 = uchar1 * uchar1 * uchar1 * uchar2 * uchar2 * uchar2; // BAD [NOT DETECTED]
ulong5 = (uchar1 + 1073741824) * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED]
ulong5 = (uchar1 + (1 << 30)) * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED]
ulong5 = uchar1 * uchar1 * uchar1 * uchar2 * uchar2 * uchar2; // $ MISSING: Alert // BAD [NOT DETECTED]
ulong5 = (uchar1 + (unsigned short)(-1)) * (uchar2 + (unsigned short)(-1)); // $ Alert // BAD
}

4
cpp/ql/test/query-tests/Likely Bugs/Arithmetic/PointlessComparison/PointlessComparison.c
View File

@@ -247,12 +247,12 @@ int overeager_wraparound(unsigned int u32bound, unsigned long long u64bound) {
unsigned long long u64idx;
for (u32idx = 1; u32idx < u32bound; u32idx++) {
if (u32idx == 0) // BAD [NOT DETECTED]
if (u32idx == 0) // $ MISSING: Alert // BAD [NOT DETECTED]
return 0;
}
for (u64idx = 1; u64idx < u64bound; u64idx++) {
if (u64idx == 0) // BAD [NOT DETECTED]
if (u64idx == 0) // $ MISSING: Alert // BAD [NOT DETECTED]
return 0;
}

2
cpp/ql/test/query-tests/Likely Bugs/Conversion/ArrayArgSizeMismatch/test.cpp
View File

@@ -25,7 +25,7 @@ void test(float f3[3], float f4[4], float f5[5], float *fp)
g(arr4); // GOOD
g(arr5); // GOOD
h(f3); // BAD [NOT DETECTED]
h(f3); // $ MISSING: Alert // BAD [NOT DETECTED]
h(f4); // GOOD
h(f5); // GOOD
h(fp); // GOOD

8
cpp/ql/test/query-tests/Likely Bugs/Conversion/LossyFunctionResultCast/test.cpp
View File

@@ -49,14 +49,14 @@ void test1()
{
// ...
}
if (getFloatRef()) // BAD [NOT DETECTED]
if (getFloatRef()) // $ MISSING: Alert // BAD [NOT DETECTED]
{
setPosInt(getFloatRef()); // BAD [NOT DETECTED]
setPosInt(getFloatRef()); // $ MISSING: Alert // BAD [NOT DETECTED]
setPosFloat(getFloatRef());
}
if (getConstFloatRef()) // BAD [NOT DETECTED]
if (getConstFloatRef()) // $ MISSING: Alert // BAD [NOT DETECTED]
{
setPosInt(getConstFloatRef()); // BAD [NOT DETECTED]
setPosInt(getConstFloatRef()); // $ MISSING: Alert // BAD [NOT DETECTED]
setPosFloat(getConstFloatRef());
}

2
cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/a.c
View File

@@ -13,7 +13,7 @@ char *getString();
void test_custom_printf1()
{
myMultiplyDefinedPrintf("string", getString()); // GOOD
myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED]
myMultiplyDefinedPrintf(getString(), "string"); // $ MISSING: Alert // BAD [NOT DETECTED]
myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
}

4
cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/b.c
View File

@@ -10,7 +10,7 @@ char *getString();
void test_custom_printf2(char *string)
{
myMultiplyDefinedPrintf("string", getString()); // GOOD
myMultiplyDefinedPrintf(getString(), "string"); // BAD [NOT DETECTED]
myMultiplyDefinedPrintf(getString(), "string"); // $ MISSING: Alert // BAD [NOT DETECTED]
myMultiplyDefinedPrintf2("string", getString()); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2(getString(), "string"); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
}
}

2
cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp
View File

@@ -48,7 +48,7 @@ int main(int argc, char **argv) { // $ Source
printf(choose_message(argc - 1), argc - 1); // GOOD
printf(messages[1]); // GOOD
printf(message); // GOOD
printf(make_message(argc - 1)); // BAD [NOT DETECTED]
printf(make_message(argc - 1)); // $ MISSING: Alert // BAD [NOT DETECTED]
printf("Hello, World\n"); // GOOD
printf(_("Hello, World\n")); // GOOD
{

2
cpp/ql/test/query-tests/Likely Bugs/Format/SnprintfOverflow/test.cpp
View File

@@ -83,7 +83,7 @@ void test6(const char *sa, const char *sb)
int pos = 0;
pos = snprintf(buffer, 100, "'%s', ", sa);
pos += snprintf(&(buffer[pos]), 100 - pos, "'%s'.", sb); // BAD [NOT DETECTED]
pos += snprintf(&(buffer[pos]), 100 - pos, "'%s'.", sb); // $ MISSING: Alert // BAD [NOT DETECTED]
}
size_t strlen(const char *str);

4
cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/a.c
View File

@@ -18,8 +18,8 @@ void test_custom_printf1()
myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments)
myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
}

4
cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/b.c
View File

@@ -15,8 +15,8 @@ void test_custom_printf2()
myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments)
myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
}

4
cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/c.c
View File

@@ -7,8 +7,8 @@ void test_custom_printf2()
myMultiplyDefinedPrintf("%i", 0, 1, 2); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments)
myMultiplyDefinedPrintf2("%i", 0); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2("%i", 0, 1); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2("%i", 0, 1, 2); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf2("%i", 0, 1, 2); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf3("%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf3("%s", "%s", "%s"); // GOOD (we can't tell which definition is correct so we have to assume this is OK)
myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
myMultiplyDefinedPrintf3("%s", "%s", "%s", "%s"); // $ MISSING: Alert // BAD (too many format arguments regardless of which definition is correct) [NOT DETECTED]
}

2
cpp/ql/test/query-tests/Likely Bugs/Format/WrongNumberOfFormatArguments/test.c
View File

@@ -30,7 +30,7 @@ void test(int i, const char *str)
printf("%1$*2$d", 0, num, width); // $ Alert[cpp/too-many-format-arguments] // BAD (too many format arguments) [INCORRECT MESSAGE]
printf("%1$*2$d", num, width); // $ SPURIOUS: Alert[cpp/too-many-format-arguments] // GOOD [FALSE POSITIVE]
printf("%1$*2$d", width); // BAD (too few format arguments) [NOT DETECTED]
printf("%1$*2$d", width); // $ MISSING: Alert // BAD (too few format arguments) [NOT DETECTED]
}
{
int precision;

4
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/second.cpp
View File

@@ -12,10 +12,10 @@ void test_size_t() {
printf("%zi", s); // GOOD
printf("%zu", s); // GOOD (we generally permit signedness changes)
printf("%zx", s); // GOOD (we generally permit signedness changes)
printf("%d", s); // BAD [NOT DETECTED]
printf("%d", s); // $ MISSING: Alert // BAD [NOT DETECTED]
printf("%ld", s); // DUBIOUS [NOT DETECTED]
printf("%lld", s); // DUBIOUS [NOT DETECTED]
printf("%u", s); // BAD [NOT DETECTED]
printf("%u", s); // $ MISSING: Alert // BAD [NOT DETECTED]
char buffer[1024];

2
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/a.c
View File

@@ -10,7 +10,7 @@ void myMultiplyDefinedPrintf2(const char *format, const char *extraArg, ...);
void test_custom_printf1()
{
myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD
myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED]
myMultiplyDefinedPrintf("%i", "%f", 1.0f); // $ MISSING: Alert // BAD [NOT DETECTED]
myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
}

4
cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Linux_signed_chars/b.c
View File

@@ -8,7 +8,7 @@ void myMultiplyDefinedPrintf2(const char *extraArg, const char *format, ...);
void test_custom_printf2()
{
myMultiplyDefinedPrintf("%i", "%f", 1); // GOOD
myMultiplyDefinedPrintf("%i", "%f", 1.0f); // BAD [NOT DETECTED]
myMultiplyDefinedPrintf("%i", "%f", 1.0f); // $ MISSING: Alert // BAD [NOT DETECTED]
myMultiplyDefinedPrintf2("%i", "%f", 1); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
myMultiplyDefinedPrintf2("%i", "%f", 1.0f); // GOOD (we can't tell which declaration is correct so we have to assume this is OK)
}
}

4
cpp/ql/test/query-tests/Likely Bugs/Likely Typos/DubiousNullCheck/DubiousNullCheck.cpp
View File

@@ -22,9 +22,9 @@ public:
myClass(myClass *ptr, myClass &ref) {
assert(ptr != NULL);
assert(y != NULL);
assert(&y != NULL); // BAD [NOT DETECTED]
assert(&y != NULL); // $ MISSING: Alert // BAD [NOT DETECTED]
assert(this->y != NULL);
assert(&this->y != NULL); // BAD [NOT DETECTED]
assert(&this->y != NULL); // $ MISSING: Alert // BAD [NOT DETECTED]
assert(ptr->y != NULL);
assert(&ptr->y != NULL); // $ Alert // BAD
assert((ptr->y) != NULL);

4
cpp/ql/test/query-tests/Likely Bugs/Likely Typos/ExprHasNoEffect/templatey.cpp
View File

@@ -15,9 +15,9 @@ void operator<<(streamable& lhs, streamable& rhs)
int main()
{
int x = 3;
foo(x, x); // BAD [NOT DETECTED]
foo(x, x); // $ MISSING: Alert // BAD [NOT DETECTED]
streamable y;
foo(y, y); // BAD [NOT DETECTED]
foo(y, y); // $ MISSING: Alert // BAD [NOT DETECTED]
return 0;
}

6
cpp/ql/test/query-tests/Likely Bugs/Likely Typos/inconsistentLoopDirection/inconsistentLoopDirection.cpp
View File

@@ -197,7 +197,7 @@ void IntendedOverflow(unsigned char p)
for (s = m + 1; s < m; s--) {} // $ Alert // BAD (never runs)
for (i = p - 1; i < p; i--) {} // GOOD
for (s = p - 1; s < p; s--) {} // BAD [NOT DETECTED]
for (s = p - 1; s < p; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED]
{
int n;
@@ -210,10 +210,10 @@ void IntendedOverflow(unsigned char p)
for (i = 63; i < n; i--) {} // GOOD
n = 64;
for (s = n - 1; s < n; s--) {} // BAD [NOT DETECTED]
for (s = n - 1; s < n; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED]
n = 64;
for (s = n - 1; s < 64; s--) {} // $ Alert // BAD
n = 64;
for (s = 63; s < n; s--) {} // BAD [NOT DETECTED]
for (s = 63; s < n; s--) {} // $ MISSING: Alert // BAD [NOT DETECTED]
}
}

2
cpp/ql/test/query-tests/Likely Bugs/Memory Management/AllocaInLoop/BoundedLoop.cpp
View File

@@ -109,7 +109,7 @@ void incBefore() {
void nestedAddsUp() {
for (int i = 0; i < 16; i++) {
for (int j = 0; j < 16; j++) {
alloca(100); // BAD [NOT DETECTED]
alloca(100); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
}

18
cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp
View File

@@ -27,8 +27,8 @@ void test_unassigned()
strdup(buffer2); // $ Alert[cpp/improper-null-termination] // BAD
memcpy(buffer2, buffer1, sizeof(buffer2));
strdup(buffer1); // BAD [NOT DETECTED]
strdup(buffer2); // BAD [NOT DETECTED]
strdup(buffer1); // $ MISSING: Alert // BAD [NOT DETECTED]
strdup(buffer2); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -196,7 +196,7 @@ void test_readlink(int fd, const char *path, size_t sz)
char *buffer = (char *)malloc(1024);
readlink(path, buffer, 1024);
strdup(buffer); // BAD [NOT DETECTED]
strdup(buffer); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -211,7 +211,7 @@ void test_readlink(int fd, const char *path, size_t sz)
char *buffer = (char *)malloc(sz);
readlink(path, buffer, sz);
strdup(buffer); // BAD [NOT DETECTED]
strdup(buffer); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -289,7 +289,7 @@ void test_strcat()
char buffer[1024];
doNothing2(buffer);
strcat(buffer, "content"); // BAD [NOT DETECTED]
strcat(buffer, "content"); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -303,7 +303,7 @@ void test_strcat()
strcat(buffer_ptr, "content"); // GOOD
buffer_ptr = buffer2;
strcat(buffer_ptr, "content"); // BAD [NOT DETECTED]
strcat(buffer_ptr, "content"); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -361,7 +361,7 @@ void test_strlen(bool cond1, bool cond2)
if (cond1)
buffer[0] = 0;
if (cond2)
strlen(buffer); // BAD [NOT DETECTED]
strlen(buffer); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -524,7 +524,7 @@ void test_printf(char *str)
char *copied_str = (char *)malloc(len);
memcpy(copied_str, str, len);
printf("%s", copied_str); // BAD [NOT DETECTED]
printf("%s", copied_str); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -580,7 +580,7 @@ void test_reassignment()
{
strcpy(buffer_ptr, "content"); // null terminates buffer1 or buffer2
buffer_ptr = buffer2;
strdup(buffer2); // BAD [NOT DETECTED]
strdup(buffer2); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
}

2
cpp/ql/test/query-tests/Likely Bugs/Memory Management/PointerOverflow/test.cpp
View File

@@ -22,7 +22,7 @@ struct Q {
void foo(int untrusted_int) {
Q q;
if (q.begin() + untrusted_int > q.end() || // GOOD (for the purpose of this test)
q.begin() + untrusted_int < q.begin()) // BAD [NOT DETECTED]
q.begin() + untrusted_int < q.begin()) // $ MISSING: Alert // BAD [NOT DETECTED]
throw q;
}

2
cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/test.cpp
View File

@@ -34,7 +34,7 @@ void test2()
wcsncpy(buf1, str, wcslen(str)); // $ Alert // BAD
wcsncpy(buf1, str, wcslen(str) + 1); // $ Alert // BAD
wcsncpy(buf1, buf2, sizeof(buf2)); // $ Alert // BAD
wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // BAD [NOT DETECTED]
wcsncpy(buf1, buf2, sizeof(buf2) / sizeof(wchar_t)); // $ Alert // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test3()

6
cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToMemset/test.cpp
View File

@@ -22,7 +22,7 @@ int main()
memset(&ms, 0, sizeof(myStruct)); // GOOD
memset(&ms, 0, sizeof(ms)); // GOOD
memset(&ms, 0, 8); // BAD [NOT DETECTED]
memset(&ms, 0, 8); // $ MISSING: Alert // BAD [NOT DETECTED]
memset(&ms, 0, sizeof(otherStruct)); // $ Alert // BAD
{
@@ -87,7 +87,7 @@ int main()
memset(&msPtrArr, 0, sizeof(myStruct *) * NUM); // GOOD
memset(&msPtrArr, 0, sizeof(myStructPtr) * NUM); // GOOD
memset(&msPtrArr, 0, sizeof(myStruct **) * NUM); // $ Alert // BAD
memset(msPtrArr, 0, sizeof(myStruct) * NUM); // BAD [NOT DETECTED]
memset(msPtrArr, 0, sizeof(myStruct) * NUM); // $ MISSING: Alert // BAD [NOT DETECTED]
memset(msPtrArr, 0, sizeof(myStruct *) * NUM); // GOOD
memset(msPtrArr, 0, sizeof(myStructPtr) * NUM); // GOOD
memset(msPtrArr, 0, sizeof(myStruct **) * NUM); // $ Alert // BAD
@@ -128,7 +128,7 @@ void myFunc(myStruct paramArray[80], myStruct &refStruct)
memset(paramArray, 0, sizeof(myStruct) * 80); // GOOD
memset(paramArray, 0, sizeof(paramArray)); // $ SPURIOUS: Alert // GOOD [FALSE POSITIVE]
memset(&paramArray, 0, sizeof(myStruct) * 80); // $ Alert // BAD
memset(&paramArray, 0, sizeof(paramArray)); // BAD [NOT DETECTED]
memset(&paramArray, 0, sizeof(paramArray)); // $ MISSING: Alert // BAD [NOT DETECTED]
memset(&refStruct, 0, sizeof(myStruct)); // GOOD
memset(&refStruct, 0, sizeof(refStruct)); // GOOD

8
cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c
View File

@@ -15,14 +15,14 @@ void good0(char *s) {
char buf[80];
strcpy(buf, "s = ");
strncat(buf, s, sizeof(buf)-5); // GOOD
strncat(buf, ".", 1); // BAD [NOT DETECTED] -- there might not be even 1 character of space
strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- there might not be even 1 character of space
}
void bad0(char *s) {
char buf[80];
strcpy(buf, "s = ");
strncat(buf, s, sizeof(buf)); // $ Alert // BAD -- Forgot to allow for "s = "
strncat(buf, ".", 1); // BAD [NOT DETECTED] -- there might not be even 1 character of space
strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- there might not be even 1 character of space
}
void good1(char *s) {
@@ -36,7 +36,7 @@ void bad1(char *s) {
char buf[80];
strcpy(buf, "s = ");
strncat(buf, s, sizeof(buf)-strlen("s = ")); // GOOD
strncat(buf, ".", 1); // BAD [NOT DETECTED] -- Need to check if any space is left
strncat(buf, ".", 1); // $ MISSING: Alert // BAD [NOT DETECTED] -- Need to check if any space is left
}
void strncat_test1(char *s) {
@@ -51,7 +51,7 @@ void strncat_test2(char *s) {
int len = 80;
char* buf = (char *)malloc(len);
strncat(buf, s, len - strlen(buf) - 1); // GOOD
strncat(buf, s, len - strlen(buf)); // BAD [NOT DETECTED]
strncat(buf, s, len - strlen(buf)); // $ MISSING: Alert // BAD [NOT DETECTED]
}
struct buffers

8
cpp/ql/test/query-tests/Likely Bugs/RedundantNullCheckSimple/RedundantNullCheckSimple.cpp
View File

@@ -39,7 +39,7 @@ void test_no_single_dominator(int *p, bool b) {
} else {
x = *p;
}
if (p == nullptr) { // BAD [NOT DETECTED]
if (p == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED]
return;
}
}
@@ -52,7 +52,7 @@ int test_postdominator_same_bb(int *p) {
}
int test_postdominator(int *p) {
int b = (p == nullptr); // BAD [NOT DETECTED]
int b = (p == nullptr); // $ MISSING: Alert // BAD [NOT DETECTED]
if (b) b++; // This line breaks up the basic block
@@ -62,7 +62,7 @@ int test_postdominator(int *p) {
}
int test_inverted_logic(int *p) {
if (p == nullptr) { // BAD [NOT DETECTED]
if (p == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED]
// The check above should probably have been `!=` instead of `==`.
return *p;
} else {
@@ -95,7 +95,7 @@ void test_field_local(bool boolvar) {
}
} else {
int *x = sp->p;
if (sp == nullptr) { // BAD [NOT DETECTED]
if (sp == nullptr) { // $ MISSING: Alert // BAD [NOT DETECTED]
return;
}
}

2
cpp/ql/test/query-tests/Likely Bugs/Underspecified Functions/test.c
View File

@@ -32,7 +32,7 @@ void test(int *argv[]) {
not_yet_declared2(1); // $ Alert[cpp/implicit-function-declaration] // BAD (GOOD for everything except for cpp/implicit-function-declaration)
not_yet_declared2(ca); // $ Alert[cpp/mistyped-function-arguments] // BAD (GOOD for everything except for cpp/mistyped-function-arguments
// and cpp/too-few-arguments. Not detected in the case of cpp/too-few-arguments.)
not_yet_declared2(); // BAD [NOT DETECTED] (GOOD for everything except for cpp/too-few-arguments)
not_yet_declared2(); // $ MISSING: Alert // BAD [NOT DETECTED] (GOOD for everything except for cpp/too-few-arguments)
declared_empty_defined_with(); // $ Alert[cpp/too-few-arguments] // BAD
declared_empty_defined_with(1); // GOOD

2
cpp/ql/test/query-tests/Likely Bugs/UseInOwnInitializer/test.cpp
View File

@@ -87,5 +87,5 @@ namespace ns3
{
const int v5 = ns1::v6 + 1; // GOOD
const int v6 = ns1::v6 + 1; // GOOD [produces INVALID_KEY trap warning]
const int v7 = ns3::v7; // BAD [NOT DETECTED]
const int v7 = ns3::v7; // $ MISSING: Alert // BAD [NOT DETECTED]
};

42
cpp/ql/test/query-tests/Security/CWE/CWE-014/test.c
View File

@@ -13,30 +13,30 @@ extern void use_pw(char *pw);
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): deleted
int func1(void) {
int func1(void) {
char pw1[PW_SIZE];
use_pw(pw1);
memset(pw1, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(pw1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
return 0;
}
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): not deleted
int func1a(void) {
int func1a(void) {
char pw1a[PW_SIZE];
use_pw(pw1a);
__builtin_memset(pw1a, 0, PW_SIZE); // BAD [NOT DETECTED]
__builtin_memset(pw1a, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
return 0;
}
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): deleted
char *func1b(void) {
char *func1b(void) {
char pw1b[PW_SIZE];
use_pw(pw1b);
memset(pw1b, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(pw1b, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
pw1b[0] = pw1b[3] = 'a';
return 0;
}
@@ -44,7 +44,7 @@ char *func1b(void) {
// x86-64 gcc 9.2: not deleted
// x86-64 clang 9.0.0: not deleted
// x64 msvc v19.14 (WINE): not deleted
int func1c(char pw1c[PW_SIZE]) {
int func1c(char pw1c[PW_SIZE]) {
use_pw(pw1c);
memset(pw1c, 0, PW_SIZE); // GOOD
return 0;
@@ -54,7 +54,7 @@ int func1c(char pw1c[PW_SIZE]) {
// x86-64 clang 9.0.0: not deleted
// x64 msvc v19.14 (WINE): not deleted
char pw1d[PW_SIZE];
int func1d() {
int func1d() {
use_pw(pw1d);
memset(pw1d, 0, PW_SIZE); // GOOD
return 0;
@@ -62,47 +62,47 @@ int func1d() {
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): deleted
char *func2(void) {
char *func2(void) {
char pw2[PW_SIZE];
use_pw(pw2);
memset(pw2, 1, PW_SIZE); // BAD [NOT DETECTED]
memset(pw2, 1, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
return pw2;
}
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): partially deleted
int func3(void) {
int func3(void) {
char pw3[PW_SIZE];
use_pw(pw3);
memset(pw3, 4, PW_SIZE); // BAD [NOT DETECTED]
memset(pw3, 4, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
return pw3[2];
}
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): not deleted
int func4(void) {
int func4(void) {
char pw1a[PW_SIZE];
use_pw(pw1a);
__builtin_memset(pw1a + 3, 0, PW_SIZE - 3); // BAD [NOT DETECTED]
__builtin_memset(pw1a + 3, 0, PW_SIZE - 3); // $ MISSING: Alert // BAD [NOT DETECTED]
return 0;
}
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): not deleted
int func6(void) {
int func6(void) {
char pw1a[PW_SIZE];
use_pw(pw1a);
__builtin_memset(&pw1a[3], 0, PW_SIZE - 3); // BAD [NOT DETECTED]
__builtin_memset(&pw1a[3], 0, PW_SIZE - 3); // $ MISSING: Alert // BAD [NOT DETECTED]
return pw1a[2];
}
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): not deleted
int func5(void) {
int func5(void) {
char pw1a[PW_SIZE];
use_pw(pw1a);
__builtin_memset(pw1a + 3, 0, PW_SIZE - 4); // GOOD
@@ -112,17 +112,17 @@ int func5(void) {
// x86-64 gcc 9.2: deleted
// x86-64 clang 9.0.0: deleted
// x64 msvc v19.14 (WINE): not deleted
int func7(void) {
int func7(void) {
char pw1a[PW_SIZE];
use_pw(pw1a);
__builtin_memset(&pw1a[3], 0, PW_SIZE - 5); // BAD [NOT DETECTED]
__builtin_memset(&pw1a[3], 0, PW_SIZE - 5); // $ MISSING: Alert // BAD [NOT DETECTED]
return 0;
}
// x86-64 gcc 9.2: not deleted
// x86-64 clang 9.0.0: not deleted
// x64 msvc v19.14 (WINE): not deleted
int func8(void) {
int func8(void) {
char pw1a[PW_SIZE];
use_pw(pw1a);
__builtin_memset(pw1a + pw1a[3], 0, PW_SIZE - 4); // GOOD
@@ -135,6 +135,6 @@ int func8(void) {
char *func9(void) {
char pw1[PW_SIZE];
use_pw(pw1);
memset(pw1, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(pw1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
return 0;
}

22
cpp/ql/test/query-tests/Security/CWE/CWE-014/test.cpp
View File

@@ -54,7 +54,7 @@ void func3(unsigned long long sz) {
void func4(unsigned long long sz) {
char buff[128];
gets(buff);
memset(buff, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(buff, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
strcpy(buff, "Hello");
}
@@ -64,7 +64,7 @@ void func4(unsigned long long sz) {
void func5(unsigned long long sz) {
char buff[128];
gets(buff);
memset(buff, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(buff, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
if (sz > 5) {
strcpy(buff, "Hello");
}
@@ -85,7 +85,7 @@ void func6(unsigned long long sz) {
void func7(unsigned long long sz) {
struct mem m;
gets(m.b);
memset(&m, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(&m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
m.a = 15;
}
@@ -95,7 +95,7 @@ void func7(unsigned long long sz) {
void func8(unsigned long long sz) {
struct mem *m = (struct mem *)malloc(sizeof(struct mem));
gets(m->b);
memset(m, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
}
// x86-64 gcc 9.2: deleted
@@ -104,7 +104,7 @@ void func8(unsigned long long sz) {
void func9(unsigned long long sz) {
struct mem *m = (struct mem *)malloc(sizeof(struct mem));
gets(m->b);
memset(m, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
free(m);
}
@@ -114,7 +114,7 @@ void func9(unsigned long long sz) {
void func10(unsigned long long sz) {
struct mem *m = (struct mem *)malloc(sizeof(struct mem));
gets(m->b);
memset(m, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
m->a = sz;
m->c = m->a + 1;
}
@@ -125,7 +125,7 @@ void func10(unsigned long long sz) {
void func11(unsigned long long sz) {
struct mem *m = (struct mem *)malloc(sizeof(struct mem));
gets(m->b);
::memset(m, 0, PW_SIZE); // BAD [NOT DETECTED]
::memset(m, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
if (sz > 5) {
strcpy(m->b, "Hello");
}
@@ -211,12 +211,12 @@ void badFunc0_0(){
void nobadFunc1_0() {
char* buff1 = (char *) malloc(PW_SIZE);
gets(buff1);
memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void badFunc1_0(){
char * buff1 = (char *) malloc(PW_SIZE);
gets(buff1);
memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
free(buff1);
}
void badFunc1_1(){
@@ -224,7 +224,7 @@ void badFunc1_1(){
for(int i = 0; i < PW_SIZE; i++) {
buff1[i] = 'a' + i;
}
memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
free(buff1);
}
void nobadFunc2_0_0(){
@@ -301,7 +301,7 @@ bool nobadFunc2_1_0(unsigned char ch){
void nobadFunc2_1_2(){
char buff1[PW_SIZE];
gets(buff1);
memset(buff1, 0, PW_SIZE); // BAD [NOT DETECTED]
memset(buff1, 0, PW_SIZE); // $ MISSING: Alert // BAD [NOT DETECTED]
buff1[2] = 5;
}

4
cpp/ql/test/query-tests/Security/CWE/CWE-114/semmle/UncontrolledProcessOperation/test.cpp
View File

@@ -77,8 +77,8 @@ void testReferencePointer2()
{
system(buffer); // $ Alert // BAD
system(data); // BAD
system(dataref); // BAD [NOT DETECTED]
system(data2); // BAD [NOT DETECTED]
system(dataref); // $ MISSING: Alert // BAD [NOT DETECTED]
system(data2); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}

10
cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/test.cpp
View File

@@ -42,7 +42,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) {
strncpy(str->string, buf, str->size + 1); // $ Alert[cpp/overrun-write] // BAD
strncpy(str->string, buf, size); // GOOD
strncpy(str->string, buf, size + 1); // BAD [NOT DETECTED]
strncpy(str->string, buf, size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
if(anotherSize < str->size) {
strncpy(str->string, buf, anotherSize); // GOOD
@@ -73,7 +73,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) {
}
if(anotherSize <= size + 1) {
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED]
}
if(anotherSize <= str->size + 2) {
@@ -81,7 +81,7 @@ void test3(unsigned size, char *buf, unsigned anotherSize) {
}
if(anotherSize <= size + 2) {
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
@@ -138,7 +138,7 @@ void test4(unsigned size, char *buf, unsigned anotherSize) {
}
if(anotherSize <= size + 2) {
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
strncpy(str->string, buf, anotherSize); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
@@ -229,7 +229,7 @@ void repeated_alerts(unsigned size, unsigned offset) {
while(unknown()) {
++size;
}
memset(buffer, 0, size); // BAD [NOT DETECTED]
memset(buffer, 0, size); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void set_string(string_t* p_str, char* buffer) {

6
cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/test_buffer_overrun.cpp
View File

@@ -5,7 +5,7 @@ void test_buffer_overrun_in_for_loop()
{
uint8_t data[SIZE] = {0};
for (int x = 0; x < SIZE * 2; x++) {
data[x] = 0x41; // BAD [NOT DETECTED]
data[x] = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
@@ -14,7 +14,7 @@ void test_buffer_overrun_in_while_loop_using_pointer_arithmetic()
uint8_t data[SIZE] = {0};
int offset = 0;
while (offset < SIZE * 2) {
*(data + offset) = 0x41; // BAD [NOT DETECTED]
*(data + offset) = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED]
offset++;
}
}
@@ -24,7 +24,7 @@ void test_buffer_overrun_in_while_loop_using_array_indexing()
uint8_t data[SIZE] = {0};
int offset = 0;
while (offset < SIZE * 2) {
data[offset] = 0x41; // BAD [NOT DETECTED]
data[offset] = 0x41; // $ MISSING: Alert // BAD [NOT DETECTED]
offset++;
}
}

2
cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp
View File

@@ -575,7 +575,7 @@ void test20()
}
num = 101;
if (fread(intBuffer, sizeof(int), num, fileSource) > 0) // BAD [NOT DETECTED]
if (fread(intBuffer, sizeof(int), num, fileSource) > 0) // $ MISSING: Alert // BAD [NOT DETECTED]
{
// ...
}

4
cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/var_size_struct.cpp
View File

@@ -51,8 +51,8 @@ void testVarString(int n) {
s1->str[1] = '?'; // GOOD
s2->str[1] = '?'; // GOOD
s3->str[1] = '?'; // GOOD
s4->str[1] = '?'; // BAD [NOT DETECTED]
s5->str[1] = '?'; // BAD [NOT DETECTED]
s4->str[1] = '?'; // $ MISSING: Alert // BAD [NOT DETECTED]
s5->str[1] = '?'; // $ MISSING: Alert // BAD [NOT DETECTED]
}
}

2
cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/tests2.cpp
View File

@@ -60,5 +60,5 @@ void test3() {
dest2 = (char*)malloc(3);
if (!dest2)
return;
snprintf(dest2, sizeof(src), "%s", src); // BAD [NOT DETECTED]
snprintf(dest2, sizeof(src), "%s", src); // $ MISSING: Alert // BAD [NOT DETECTED]
}

4
cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/unions.c
View File

@@ -22,12 +22,12 @@ void unions_test(MyUnion *mu)
strcpy(mu, "1234567890"); // GOOD
strcpy(&(mu->ptr), "1234567890"); // GOOD (dubious)
strcpy(&(mu->buffer), "1234567890"); // GOOD
strcpy(mu, "12345678901234567890"); // BAD [NOT DETECTED]
strcpy(mu, "12345678901234567890"); // $ MISSING: Alert // BAD [NOT DETECTED]
strcpy(&(mu->ptr), "12345678901234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD
strcpy(&(mu->buffer), "12345678901234567890"); // $ Alert[cpp/very-likely-overrunning-write] // BAD
mu->ptr = buffer;
strcpy(mu->ptr, "1234567890"); // GOOD
strcpy(mu->ptr, "12345678901234567890"); // GOOD
strcpy(mu->ptr, "123456789012345678901234567890"); // BAD [NOT DETECTED]
strcpy(mu->ptr, "123456789012345678901234567890"); // $ MISSING: Alert // BAD [NOT DETECTED]
}

4
cpp/ql/test/query-tests/Security/CWE/CWE-131/NoSpaceForZeroTerminator/test2.cpp
View File

@@ -39,7 +39,7 @@ namespace std
//// Test code /////
static void bad1(char *str) {
// BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
// $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
char *buffer = (char *)malloc(strlen(str));
std::string str2(buffer);
free(buffer);
@@ -53,7 +53,7 @@ static void good1(char *str) {
}
static void bad2(wchar_t *str) {
// BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
// $ MISSING: Alert // BAD -- Not allocating space for '\0' terminator [NOT DETECTED]
wchar_t *buffer = (wchar_t *)calloc(wcslen(str), sizeof(wchar_t));
wcscpy(buffer, str);
free(buffer);

10
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.c
View File

@@ -68,7 +68,7 @@ void randomTester() {
}
{
int r = rand() + 100; // BAD [NOT DETECTED]
int r = rand() + 100; // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -84,20 +84,20 @@ void randomTester() {
}
{
int r = RAND2() + 100; // BAD [NOT DETECTED]
int r = RAND2() + 100; // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
int r = RAND();
int *ptr_r = &r;
*ptr_r += 100; // BAD [NOT DETECTED]
*ptr_r += 100; // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
int r = 0;
int *ptr_r = &r;
*ptr_r = RAND();
r += 100; // BAD [NOT DETECTED]
r += 100; // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
@@ -142,7 +142,7 @@ void moreTests() {
{
int r = rand();
r <<= 8; // BAD [NOT DETECTED]
r <<= 8; // $ MISSING: Alert // BAD [NOT DETECTED]
}
{

6
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticUncontrolled/test.cpp
View File

@@ -157,8 +157,8 @@ int test_underflow()
int test_cast()
{
int x = rand();
short a = x; // BAD [NOT DETECTED]
short b = -x; // BAD [NOT DETECTED]
short a = x; // $ MISSING: Alert // BAD [NOT DETECTED]
short b = -x; // $ MISSING: Alert // BAD [NOT DETECTED]
long long c = x; // GOOD
long long d = -x; // GOOD
}
@@ -174,7 +174,7 @@ void test_float()
{
int x = rand();
float y = x * 5.0f; // GOOD
int z = y; // BAD [NOT DETECTED]
int z = y; // $ MISSING: Alert // BAD [NOT DETECTED]
}
{

12
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/ArithmeticWithExtremeValues/test.c
View File

@@ -65,7 +65,7 @@ void test_crement() {
sc9 += 1; // GOOD
sc10 = 1;
sc10 += CHAR_MAX; // BAD [NOT DETECTED]
sc10 += CHAR_MAX; // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test_negatives() {
@@ -75,13 +75,13 @@ void test_negatives() {
sc1 += 0; // GOOD
sc1 += -1; // GOOD
sc2 = CHAR_MIN;
sc2 += -1; // BAD [NOT DETECTED]
sc2 += -1; // $ MISSING: Alert // BAD [NOT DETECTED]
sc3 = CHAR_MIN;
sc3 = sc3 + -1; // BAD [NOT DETECTED]
sc3 = sc3 + -1; // $ MISSING: Alert // BAD [NOT DETECTED]
sc4 = CHAR_MAX;
sc4 -= -1; // BAD [NOT DETECTED]
sc4 -= -1; // $ MISSING: Alert // BAD [NOT DETECTED]
sc5 = -1;
sc5 += CHAR_MIN; // BAD [NOT DETECTED]
sc5 += CHAR_MIN; // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test_guards1(int cond) {
@@ -101,7 +101,7 @@ void test_guards2(int cond) {
if (x < 128) return;
return x + 1; // BAD [NOT DETECTED]
return x + 1; // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test_guards3(int cond) {

8
cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
View File

@@ -42,7 +42,7 @@ int main(int argc, char **argv) { // $ Source
MyStruct *arr1 = (MyStruct *)malloc(sizeof(MyStruct)); // GOOD
MyStruct *arr2 = (MyStruct *)malloc(tainted); // $ Alert // BAD
MyStruct *arr3 = (MyStruct *)malloc(tainted * sizeof(MyStruct)); // $ Alert // BAD
MyStruct *arr4 = (MyStruct *)malloc(getTainted() * sizeof(MyStruct)); // BAD [NOT DETECTED]
MyStruct *arr4 = (MyStruct *)malloc(getTainted() * sizeof(MyStruct)); // $ MISSING: Alert // BAD [NOT DETECTED]
MyStruct *arr5 = (MyStruct *)malloc(sizeof(MyStruct) + tainted); // $ Alert // BAD
int size = tainted * 8;
@@ -158,7 +158,7 @@ void more_bounded_tests() {
if (size < 100)
{
malloc(size * sizeof(int)); // BAD [NOT DETECTED]
malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
@@ -213,7 +213,7 @@ void more_bounded_tests() {
{
int size = atoi(getenv("USER"));
malloc(size * sizeof(int)); // BAD [NOT DETECTED]
malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
if ((size > 0) && (size < 100))
{
@@ -226,7 +226,7 @@ void more_bounded_tests() {
if (size > 100)
{
malloc(size * sizeof(int)); // BAD [NOT DETECTED]
malloc(size * sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
}

36
cpp/ql/test/query-tests/Security/CWE/CWE-193/test.cpp
View File

@@ -6,9 +6,9 @@ void test1(int size) {
char a = *q; // $ deref=L5->L6 Alert[cpp/invalid-pointer-deref]=r1 // BAD
char b = *(q - 1); // GOOD
char c = *(q + 1); // $ deref=L5->L8+1 Alert[cpp/invalid-pointer-deref]=r2 // BAD
char d = *(q + size); // BAD [NOT DETECTED]
char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED]
char e = *(q - size); // GOOD
char f = *(q + size + 1); // BAD [NOT DETECTED]
char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
char g = *(q - size - 1); // GOOD
}
@@ -18,9 +18,9 @@ void test2(int size) {
char a = *q; // GOOD
char b = *(q - 1); // GOOD
char c = *(q + 1); // $ deref=L17->L20 Alert[cpp/invalid-pointer-deref]=r3 // BAD
char d = *(q + size); // BAD [NOT DETECTED]
char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED]
char e = *(q - size); // GOOD
char f = *(q + size + 1); // BAD [NOT DETECTED]
char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
char g = *(q - size - 1); // GOOD
}
@@ -30,21 +30,21 @@ void test3(int size) {
char a = *q; // $ deref=L29->L30 Alert[cpp/invalid-pointer-deref]=r4 // BAD
char b = *(q - 1); // GOOD
char c = *(q + 1); // $ deref=L29->L32+1 Alert[cpp/invalid-pointer-deref]=r5 // BAD
char d = *(q + size); // BAD [NOT DETECTED]
char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED]
char e = *(q - size); // GOOD
char f = *(q + size + 1); // BAD [NOT DETECTED]
char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
char g = *(q - size - 1); // GOOD
}
void test4(int size) {
char* p = (char*)malloc(size - 1);
char* q = p + (size - 1); // $ MISSING: alloc=L40-1
char a = *q; // $ MISSING: deref=L42 // BAD [NOT DETECTED]
char a = *q; // $ MISSING: deref=L42 // $ MISSING: Alert // BAD [NOT DETECTED]
char b = *(q - 1); // GOOD
char c = *(q + 1); // $ MISSING: deref=L44+1 // BAD [NOT DETECTED]
char d = *(q + size); // BAD [NOT DETECTED]
char c = *(q + 1); // $ MISSING: deref=L44+1 // $ MISSING: Alert // BAD [NOT DETECTED]
char d = *(q + size); // $ MISSING: Alert // BAD [NOT DETECTED]
char e = *(q - size); // GOOD
char f = *(q + size + 1); // BAD [NOT DETECTED]
char f = *(q + size + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
char g = *(q - size - 1); // GOOD
}
@@ -93,7 +93,7 @@ void test6(int size) {
}
for (char* p = arr.begin; p <= arr.end; ++p) {
*p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 // BAD [NOT DETECTED]
*p = 0; // $ MISSING: deref=L83->L91->L96 deref=L83->L95->L96 // $ MISSING: Alert // BAD [NOT DETECTED]
}
for (char* p = arr.begin; p < arr.end; ++p) {
@@ -107,7 +107,7 @@ void test7_callee(array_t arr) {
}
for (char* p = arr.begin; p <= arr.end; ++p) {
*p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 // BAD [NOT DETECTED]
*p = 0; // $ MISSING: deref=L83->L105->L110 deref=L83->L109->L110 // $ MISSING: Alert // BAD [NOT DETECTED]
}
for (char* p = arr.begin; p < arr.end; ++p) {
@@ -134,7 +134,7 @@ void test8(int size) {
}
for (int i = 0; i <= arr.end - arr.begin; i++) {
*(arr.begin + i) = 0; // BAD [NOT DETECTED]
*(arr.begin + i) = 0; // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
@@ -154,7 +154,7 @@ void test9(int size) {
}
for (char* p = arr->begin; p <= arr->end; ++p) {
*p = 0; // $ MISSING: deref=L144->L156->L157 // BAD [NOT DETECTED]
*p = 0; // $ MISSING: deref=L144->L156->L157 // $ MISSING: Alert // BAD [NOT DETECTED]
}
for (char* p = arr->begin; p < arr->end; ++p) {
@@ -168,7 +168,7 @@ void test10_callee(array_t *arr) {
}
for (char* p = arr->begin; p <= arr->end; ++p) {
*p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 // BAD [NOT DETECTED]
*p = 0; // $ MISSING: deref=L144->L166->L171 deref=L144->L170->L171 // $ MISSING: Alert // BAD [NOT DETECTED]
}
for (char* p = arr->begin; p < arr->end; ++p) {
@@ -181,7 +181,7 @@ void test10(int size) {
}
void deref_plus_one(char* q) {
char a = *(q + 1); // BAD [NOT DETECTED]
char a = *(q + 1); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test11(unsigned size) {
@@ -198,7 +198,7 @@ void test12(unsigned len, unsigned index) {
return;
}
p[index] = '\0'; // $ MISSING: deref=L195->L201 // BAD [NOT DETECTED]
p[index] = '\0'; // $ MISSING: deref=L195->L201 // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test13(unsigned len, unsigned index) {
@@ -703,7 +703,7 @@ void test34(unsigned size) {
}
void deref(char* q) {
char x = *q; // $ MISSING: deref=L714->L705->L706 // BAD [NOT DETECTED]
char x = *q; // $ MISSING: deref=L714->L705->L706 // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test35(size_t size, char* q)

4
cpp/ql/test/query-tests/Security/CWE/CWE-295/test.cpp
View File

@@ -113,7 +113,7 @@ void test1_1(SSL *ssl)
{
int result = SSL_get_verify_result(ssl);
if (result == 1) // BAD (conflates OK and a non-OK codes in `else`) [NOT DETECTED]
if (result == 1) // $ MISSING: Alert // BAD (conflates OK and a non-OK codes in `else`) [NOT DETECTED]
{
} else {
}
@@ -139,7 +139,7 @@ void test1_3(SSL *ssl)
{
int result = SSL_get_verify_result(ssl);
if (result == 0) { // BAD (error code 1 is treated as OK, not as non-OK) [NOT DETECTED]
if (result == 0) { // $ MISSING: Alert // BAD (error code 1 is treated as OK, not as non-OK) [NOT DETECTED]
do_good();
} else if (result == 1) {
do_good();

4
cpp/ql/test/query-tests/Security/CWE/CWE-311/semmle/tests/test3.cpp
View File

@@ -536,14 +536,14 @@ void tests2(person_info *pi)
char buffer[1024];
snprintf(buffer, 1024, "salary = %i\n", pi->newSalary);
send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED]
send(val(), buffer, strlen(buffer), val()); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
char buffer[1024];
int sal = pi->newSalary;
snprintf(buffer, 1024, "salary = %i\n", sal);
send(val(), buffer, strlen(buffer), val()); // BAD [NOT DETECTED]
send(val(), buffer, strlen(buffer), val()); // $ MISSING: Alert // BAD [NOT DETECTED]
}
{
char buffer[1024];

22
cpp/ql/test/query-tests/Security/CWE/CWE-327/test.cpp
View File

@@ -43,10 +43,10 @@ void test_macros(void *data, size_t amount, const char *str)
ENCRYPT_WITH_RC20(data, amount); // GOOD (if there ever is an RC20 algorithm, we have no reason to believe it's weak)
ENCRYPT_WITH_DES_REMOVED(data, amount); // GOOD (implementation has been deleted)
DESENCRYPT(data, amount); // BAD [NOT DETECTED]
RC2ENCRYPT(data, amount); // BAD [NOT DETECTED]
DESENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
RC2ENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
AESENCRYPT(data, amount); // GOOD (good algorithm)
DES3ENCRYPT(data, amount); // BAD [NOT DETECTED]
DES3ENCRYPT(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
DES_DO_ENCRYPTION(data, amount); // BAD
RUN_DES_ENCODING(data, amount); // BAD
@@ -91,16 +91,16 @@ void test_functions(void *data, size_t amount, const char *str)
encrypt3DES(data, amount); // BAD
encryptTripleDES(data, amount); // BAD
DESEncrypt(data, amount); // BAD [NOT DETECTED]
RC2Encrypt(data, amount); // BAD [NOT DETECTED]
DESEncrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
RC2Encrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
AESEncrypt(data, amount); // GOOD (good algorithm)
DES3Encrypt(data, amount); // BAD [NOT DETECTED]
DES3Encrypt(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
DoDESEncryption(data, amount); // BAD [NOT DETECTED]
encryptDes(data, amount); // BAD [NOT DETECTED]
DoDESEncryption(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
encryptDes(data, amount); // $ MISSING: Alert // BAD [NOT DETECTED]
do_des_encrypt(data, amount); // BAD
DES_Set_Key(str); // BAD [NOT DETECTED]
DESSetKey(str); // BAD [NOT DETECTED]
DES_Set_Key(str); // $ MISSING: Alert // BAD [NOT DETECTED]
DESSetKey(str); // $ MISSING: Alert // BAD [NOT DETECTED]
Des(); // GOOD (probably nothing to do with encryption)
Desmond(str); // GOOD (probably nothing to do with encryption)
@@ -118,7 +118,7 @@ void my_implementation8();
void test_macros2()
{
INIT_ENCRYPT_WITH_DES(); // BAD [NOT DETECTED]
INIT_ENCRYPT_WITH_DES(); // $ MISSING: Alert // BAD [NOT DETECTED]
INIT_ENCRYPT_WITH_AES(); // GOOD (good algorithm)
// ...

16
cpp/ql/test/query-tests/Security/CWE/CWE-327/test2.cpp
View File

@@ -173,13 +173,13 @@ const char *get_algorithm3();
void do_unseen_encrypts(char *data, size_t amount, keytype key)
{
set_encryption_algorithm1(ALGO_DES); // BAD [NOT DETECTED]
set_encryption_algorithm1(ALGO_DES); // $ MISSING: Alert // BAD [NOT DETECTED]
set_encryption_algorithm1(ALGO_AES); // GOOD
set_encryption_algorithm2(USE_DES); // BAD [NOT DETECTED]
set_encryption_algorithm2(USE_DES); // $ MISSING: Alert // BAD [NOT DETECTED]
set_encryption_algorithm2(USE_AES); // GOOD
set_encryption_algorithm3("DES"); // BAD [NOT DETECTED]
set_encryption_algorithm3("DES"); // $ MISSING: Alert // BAD [NOT DETECTED]
set_encryption_algorithm3("AES"); // GOOD
set_encryption_algorithm3("AES-256"); // GOOD
@@ -189,7 +189,7 @@ void do_unseen_encrypts(char *data, size_t amount, keytype key)
encryption_with2(data, amount, key, USE_DES); // BAD
encryption_with2(data, amount, key, USE_AES); // GOOD
encryption_with3(data, amount, key, "DES"); // BAD [NOT DETECTED]
encryption_with3(data, amount, key, "DES"); // $ MISSING: Alert // BAD [NOT DETECTED]
encryption_with3(data, amount, key, "AES"); // GOOD
encryption_with3(data, amount, key, "AES-256"); // GOOD
@@ -258,7 +258,7 @@ void do_fn_ptr(char *data, size_t amount, keytype key)
{
implementation_fn_ptr impl;
impl = &my_des_implementation; // BAD [NOT DETECTED]
impl = &my_des_implementation; // $ MISSING: Alert // BAD [NOT DETECTED]
impl(data, amount, key);
impl = &my_aes_implementation; // GOOD
@@ -302,12 +302,12 @@ public:
void do_template_classes(char *data)
{
desEncryptor *p = new desEncryptor(); // BAD
container<desEncryptor> c; // BAD [NOT DETECTED]
templateDesEncryptor<char *> t; // BAD [NOT DETECTED]
container<desEncryptor> c; // $ MISSING: Alert // BAD [NOT DETECTED]
templateDesEncryptor<char *> t; // $ MISSING: Alert // BAD [NOT DETECTED]
p->doDesEncryption(data); // BAD
c.obj->doDesEncryption(data); // BAD
t.doDesEncryption(data); // BAD [NOT DETECTED]
t.doDesEncryption(data); // $ MISSING: Alert // BAD [NOT DETECTED]
}
// --- assert ---

8
cpp/ql/test/query-tests/Security/CWE/CWE-367/semmle/test2.cpp
View File

@@ -180,7 +180,7 @@ void test2_9(const char *path, int arg)
if (stat(path, &buf))
{
f = creat(path, arg); // BAD [NOT DETECTED]
f = creat(path, arg); // $ MISSING: Alert // BAD [NOT DETECTED]
}
// ...
@@ -193,7 +193,7 @@ void test2_10(int dir, const char *path, int arg)
if (fstatat(dir, path, &buf))
{
f = openat(dir, path, arg); // BAD [NOT DETECTED]
f = openat(dir, path, arg); // $ MISSING: Alert // BAD [NOT DETECTED]
}
// ...
@@ -259,7 +259,7 @@ void test3_1(const char *path, int arg)
int f;
f = open(path, arg);
if (stat(path, &buf)) // BAD [NOT DETECTED]
if (stat(path, &buf)) // $ MISSING: Alert // BAD [NOT DETECTED]
{
// ...
}
@@ -314,7 +314,7 @@ void test5_2(const char *path1, const char *path2)
if (!rename(path1, path2))
{
f = fopen(path2, "r"); // BAD [NOT DETECTED]
f = fopen(path2, "r"); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}

6
cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/IteratorToExpiredContainer/test.cpp
View File

@@ -686,7 +686,7 @@ void test() {
for (auto x : returnRef()[0]) {} // GOOD
for (auto x : returnRef().at(0)) {} // GOOD
for(auto it = returnValue().begin(); it != returnValue().end(); ++it) {} // BAD [NOT DETECTED]
for(auto it = returnValue().begin(); it != returnValue().end(); ++it) {} // $ MISSING: Alert // BAD [NOT DETECTED]
{
auto v = returnValue();
@@ -713,7 +713,7 @@ void test() {
for(auto it = v.begin(); it != v.end(); ++it) {} // GOOD
}
for (auto x : return_self_by_ref(returnValue())) {} // BAD [NOT DETECTED]
for (auto x : return_self_by_ref(returnValue())) {} // $ MISSING: Alert // BAD [NOT DETECTED]
for (auto x : return_self_by_value(returnValue())) {} // GOOD
}
@@ -728,7 +728,7 @@ std::vector<int>& ref_to_first_in_returnValue_1() {
}
std::vector<int>& ref_to_first_in_returnValue_2() {
return returnValue()[0]; // BAD [NOT DETECTED]
return returnValue()[0]; // $ MISSING: Alert // BAD [NOT DETECTED]
}
std::vector<int>& ref_to_first_in_returnValue_3() {

20
cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp
View File

@@ -37,7 +37,7 @@ void test1()
data = (char *)malloc(100*sizeof(char));
use_if_nonzero(data); // GOOD
free(data); // $ Source
use_if_nonzero(data); // BAD [NOT DETECTED]
use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
use(data); // $ Alert // BAD
}
@@ -75,7 +75,7 @@ void test4()
free(data); // $ Source
if (data)
{
use_if_nonzero(data); // BAD [NOT DETECTED]
use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
use(data); // $ Alert // BAD
}
}
@@ -94,8 +94,8 @@ char* returnsFreedData(int i)
void test5()
{
char* data = returnsFreedData(1);
use_if_nonzero(data); // BAD [NOT DETECTED]
use(data); // BAD [NOT DETECTED]
use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
use(data); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test6()
@@ -104,7 +104,7 @@ void test6()
data = (char *)malloc(100*sizeof(char));
data2 = data;
free(data); // $ Source
use_if_nonzero(data2); // BAD [NOT DETECTED]
use_if_nonzero(data2); // $ MISSING: Alert // BAD [NOT DETECTED]
use(data); // $ Alert // BAD
}
@@ -115,7 +115,7 @@ void test7()
data2 = data;
free(data); // $ Source
data2 = NULL;
use_if_nonzero(data); // BAD [NOT DETECTED]
use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
use(data); // $ Alert // BAD
}
@@ -126,7 +126,7 @@ void test8()
data = data2;
free(data); // $ Source
data2 = NULL;
use_if_nonzero(data); // BAD [NOT DETECTED]
use_if_nonzero(data); // $ MISSING: Alert // BAD [NOT DETECTED]
use(data); // $ Alert // BAD
}
@@ -171,8 +171,8 @@ template<class T> T test()
T* x;
use(x); // GOOD
delete x;
use_if_nonzero(x); // BAD [NOT DETECTED]
use(x); // BAD [NOT DETECTED]
use_if_nonzero(x); // $ MISSING: Alert // BAD [NOT DETECTED]
use(x); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test12(int count)
@@ -214,7 +214,7 @@ template<class T> T test15()
T* x;
use(x); // GOOD
delete x; // $ Source
use(x); // $ Alert // BAD [NOT DETECTED]
use(x); // $ Alert // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test15runner(void)
{

4
cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp
View File

@@ -27,12 +27,12 @@ void test1()
use(b);
}
if (maybeInitialize1(&c) == 0) // BAD (initialization check is wrong) [NOT DETECTED]
if (maybeInitialize1(&c) == 0) // $ MISSING: Alert // BAD (initialization check is wrong) [NOT DETECTED]
{
use(c);
}
result1 = maybeInitialize1(&d); // BAD (initialization stored but not checked) [NOT DETECTED]
result1 = maybeInitialize1(&d); // $ MISSING: Alert // BAD (initialization stored but not checked) [NOT DETECTED]
use(d);
result2 = maybeInitialize1(&e); // GOOD

6
cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/tests/test.cpp
View File

@@ -27,7 +27,7 @@ void test4(bool b) {
if (b) {
foo = 1;
}
use(foo); // BAD [NOT DETECTED]
use(foo); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test5() {
@@ -43,7 +43,7 @@ void test5(int count) {
for (int i = 0; i < count; i++) {
foo = i;
}
use(foo); // BAD [NOT DETECTED]
use(foo); // $ MISSING: Alert // BAD [NOT DETECTED]
}
void test6(bool b) {
@@ -523,7 +523,7 @@ int non_exhaustive_switch(State s) {
y = 2;
break;
}
return y; // BAD [NOT DETECTED] (y is not initialized when s = StateC)
return y; // $ MISSING: Alert // BAD [NOT DETECTED] (y is not initialized when s = StateC)
}
int non_exhaustive_switch_2(State s) {

4
cpp/ql/test/query-tests/Security/CWE/CWE-468/semmle/SuspiciousAddWithSizeof/buildless.cpp
View File

@@ -5,6 +5,6 @@ void test_buildless(const char *p_c, const short *p_short, const int *p_int, con
*(p_short + sizeof(int)); // $ Alert // BAD
*(p_int + sizeof(int)); // $ Alert // BAD
*(p_8 + sizeof(int)); // GOOD (`sizeof(uint8_t)` is 1, but there's an error in the type)
*(p_16 + sizeof(int)); // BAD [NOT DETECTED]
*(p_32 + sizeof(int)); // BAD [NOT DETECTED]
*(p_16 + sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
*(p_32 + sizeof(int)); // $ MISSING: Alert // BAD [NOT DETECTED]
}

4
cpp/ql/test/query-tests/Security/CWE/CWE-611/tests4.cpp
View File

@@ -96,7 +96,7 @@ void test4_8(const char *fileName) {
xmlDoc *p;
int flags = XML_PARSE_OPTION_HARMLESS;
p = xmlReadFile(fileName, NULL, flags | XML_PARSE_NOENT); // BAD (parser not correctly configured) [NOT DETECTED]
p = xmlReadFile(fileName, NULL, flags | XML_PARSE_NOENT); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED]
if (p != NULL)
{
xmlFreeDoc(p);
@@ -107,7 +107,7 @@ void test4_9(const char *fileName) {
xmlDoc *p;
int flags = XML_PARSE_NOENT;
p = xmlReadFile(fileName, NULL, flags | XML_PARSE_OPTION_HARMLESS); // BAD (parser not correctly configured) [NOT DETECTED]
p = xmlReadFile(fileName, NULL, flags | XML_PARSE_OPTION_HARMLESS); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED]
if (p != NULL)
{
xmlFreeDoc(p);

4
cpp/ql/test/query-tests/Security/CWE/CWE-611/tests5.cpp
View File

@@ -93,11 +93,11 @@ void test5_8(DOMImplementationLS *impl, InputSource &data) {
DOMLSParser *p = impl->createLSParser();
DOMConfiguration *cfg = p->getDomConfig();
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
p->parse(data); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED]
cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, true);
p->parse(data); // GOOD
cfg->setParameter(XMLUni::fgXercesDisableDefaultEntityResolution, false);
p->parse(data); // BAD (parser not correctly configured) [NOT DETECTED]
p->parse(data); // $ MISSING: Alert // BAD (parser not correctly configured) [NOT DETECTED]
}

8
cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/test.cpp
View File

@@ -15,7 +15,7 @@ extern const char* adminCookie;
const char *currentUser;
void processRequest()
void processRequest()
{
const char *userName = getenv("USER_NAME"); // $ Source
@@ -35,17 +35,17 @@ void processRequest()
adminPrivileges = 0; // OK, since it's a 0 and not a 1
}
// BAD (requires pointer analysis to catch) [NOT DETECTED]
// $ MISSING: Alert // BAD (requires pointer analysis to catch) [NOT DETECTED]
const char** userp = &currentUser;
*userp = userName;
if (!strcmp(currentUser, "admin")) {
adminPrivileges = 1;
adminPrivileges = 1;
}
}
void bugWithBinop() {
const char *userName = getenv("USER_NAME");
// The following is tainted, but should not cause
// the whole program to be considered tainted.
int bytes = strlen(userName) + 1;

6
cpp/ql/test/query-tests/Security/CWE/CWE-843/test.cpp
View File

@@ -138,7 +138,7 @@ void test12() {
// This has doesn't have any non-bitfield member, so we don't detect
// the problem here since the query currently ignores bitfields.
S1* s1 = new S1;
HasBitFields* hbf = reinterpret_cast<HasBitFields*>(s1); // BAD [NOT DETECTED]
HasBitFields* hbf = reinterpret_cast<HasBitFields*>(s1); // $ MISSING: Alert // BAD [NOT DETECTED]
S1* s1_2 = new S1; // $ Source
// This one has a non-bitfield members. So we detect the problem
@@ -168,7 +168,7 @@ void test14(bool b) {
a = new Dog;
}
if(!b) {
Cat* d = static_cast<Cat*>(a); // BAD [NOT DETECTED]
Cat* d = static_cast<Cat*>(a); // $ MISSING: Alert // BAD [NOT DETECTED]
}
}
@@ -206,7 +206,7 @@ union MyUnion
void test16() {
void* si = new SingleInt;
// ...
MyUnion* mu = (MyUnion*)si; // BAD [NOT DETECTED]
MyUnion* mu = (MyUnion*)si; // $ MISSING: Alert // BAD [NOT DETECTED]
}
struct UnrelatedStructSize {

4
cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/DeleteThis.cpp
View File

@@ -125,8 +125,8 @@ public:
c = new MyClass6(); // GOOD
d = new MyClass7(); // $ Alert // BAD
e = new MyClass7(); // BAD [NOT DETECTED]
f = new MyClass8(); // BAD [NOT DETECTED]
e = new MyClass7(); // $ MISSING: Alert // BAD [NOT DETECTED]
f = new MyClass8(); // $ MISSING: Alert // BAD [NOT DETECTED]
}
~MyClass9()
{

2
cpp/ql/test/query-tests/jsf/4.10 Classes/AV Rule 79/QObject.cpp
View File

@@ -13,7 +13,7 @@ class MyQtUser {
MyQtUser(QObject *parent) {
// This object sets its parent pointer to null and thus must be deleted
// manually.
noParent = new DerivedFromQObject(nullptr); // BAD [NOT DETECTED]
noParent = new DerivedFromQObject(nullptr); // $ MISSING: Alert // BAD [NOT DETECTED]
// This object does not need to be deleted because it will be deleted by
// its parent object when the time is right.

6
cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 164/test.c
View File

@@ -10,10 +10,10 @@ void f(unsigned char uc, signed char sc, int i) {
uc << 7;
uc << 8; // $ Alert // BAD
uc >>= -1; // BAD [NOT DETECTED]
uc >>= 0; // BAD [NOT DETECTED]
uc >>= -1; // $ MISSING: Alert // BAD [NOT DETECTED]
uc >>= 0; // $ MISSING: Alert // BAD [NOT DETECTED]
uc >>= 7;
uc >>= 8; // BAD [NOT DETECTED]
uc >>= 8; // $ MISSING: Alert // BAD [NOT DETECTED]
sc >> -1; // $ Alert // BAD
sc >> 0;

2
cpp/ql/test/query-tests/jsf/4.21 Operators/AV Rule 165/test.c
View File

@@ -23,5 +23,5 @@ void f(int i, unsigned int ui, signed int si, TUI tui, volatile unsigned int vui
vui = -vui; // $ Alert // BAD
u = -u; // $ Alert // BAD
us = -us; // $ Alert // BAD
ui = -(5U); // BAD [NOT DETECTED]
ui = -(5U); // $ MISSING: Alert // BAD [NOT DETECTED]
}