diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected index 981b1fc8265..e0bafea2d11 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected @@ -1,16 +1,16 @@ edges | main.cpp:6:27:6:30 | argv indirection | main.cpp:10:20:10:23 | argv indirection | -| main.cpp:10:20:10:23 | argv indirection | tests.cpp:618:32:618:35 | argv indirection | +| main.cpp:10:20:10:23 | argv indirection | tests.cpp:631:32:631:35 | argv indirection | | tests.cpp:613:19:613:24 | source indirection | tests.cpp:615:17:615:22 | source indirection | -| tests.cpp:618:32:618:35 | argv indirection | tests.cpp:643:9:643:15 | access to array indirection | -| tests.cpp:643:9:643:15 | access to array indirection | tests.cpp:613:19:613:24 | source indirection | +| tests.cpp:631:32:631:35 | argv indirection | tests.cpp:656:9:656:15 | access to array indirection | +| tests.cpp:656:9:656:15 | access to array indirection | tests.cpp:613:19:613:24 | source indirection | nodes | main.cpp:6:27:6:30 | argv indirection | semmle.label | argv indirection | | main.cpp:10:20:10:23 | argv indirection | semmle.label | argv indirection | | tests.cpp:613:19:613:24 | source indirection | semmle.label | source indirection | | tests.cpp:615:17:615:22 | source indirection | semmle.label | source indirection | -| tests.cpp:618:32:618:35 | argv indirection | semmle.label | argv indirection | -| tests.cpp:643:9:643:15 | access to array indirection | semmle.label | access to array indirection | +| tests.cpp:631:32:631:35 | argv indirection | semmle.label | argv indirection | +| tests.cpp:656:9:656:15 | access to array indirection | semmle.label | access to array indirection | subpaths #select | tests.cpp:615:2:615:7 | call to strcpy | main.cpp:6:27:6:30 | argv indirection | tests.cpp:615:17:615:22 | source indirection | This 'call to strcpy' with input from $@ may overflow the destination. | main.cpp:6:27:6:30 | argv indirection | a command-line argument | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp index b621eb473fd..840ec23a139 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp @@ -615,6 +615,19 @@ void test24(char* source) { strcpy(buffer, source); // BAD } +struct my_struct { + char* home; +}; + +void test25(char* source) { + my_struct s; + + s.home = source; + + char buf[100]; + strcpy(buf, s.home); // BAD [NOT DETECTED] +} + int tests_main(int argc, char *argv[]) { long long arr17[19]; @@ -641,6 +654,7 @@ int tests_main(int argc, char *argv[]) test22(argc == 0, argv[0]); test23(); test24(argv[0]); + test25(argv[0]); return 0; }