mirror of
https://github.com/github/codeql.git
synced 2026-05-05 21:55:19 +02:00
C++: Rename PointerWrapAround to PointerOverflow
Overflow was the terminology I found for this in the C standard (C11 6.5.6-8).
This commit is contained in:
@@ -0,0 +1,42 @@
|
||||
struct P { int a, b; };
|
||||
bool check_pointer_overflow(P *ptr) {
|
||||
// x86-64 gcc 9.2 -O2: deleted
|
||||
// x86-64 clang 9.9.9 -O2: deleted
|
||||
// x64 msvc v19.22 /O2: not deleted
|
||||
return ptr + 0x12345678 < ptr; // BAD
|
||||
}
|
||||
bool check_pointer_overflow(P *ptr, P *ptr_end) {
|
||||
// x86-64 gcc 9.2 -O2: not deleted
|
||||
// x86-64 clang 9.0.0 -O2: not deleted
|
||||
// x64 msvc v19.22 /O2: not deleted
|
||||
return ptr_end - ptr > 4; // GOOD
|
||||
}
|
||||
|
||||
struct Q {
|
||||
#define Q_SIZE 32
|
||||
char arr[Q_SIZE];
|
||||
char *begin() { return &arr[0]; }
|
||||
char *end() { return &arr[Q_SIZE]; }
|
||||
};
|
||||
|
||||
void foo(int untrusted_int) {
|
||||
Q q;
|
||||
if (q.begin() + untrusted_int > q.end() || // GOOD (for the purpose of this test)
|
||||
q.begin() + untrusted_int < q.begin()) // BAD [NOT DETECTED]
|
||||
throw q;
|
||||
}
|
||||
|
||||
typedef unsigned long size_t;
|
||||
|
||||
bool not_in_range_bad(Q *ptr, Q *ptr_end, size_t a) {
|
||||
return ptr + a >= ptr_end || // GOOD (for the purpose of this test)
|
||||
ptr + a < ptr; // BAD
|
||||
}
|
||||
|
||||
bool not_in_range_good(Q *ptr, Q *ptr_end, size_t a) {
|
||||
return a >= ptr_end - ptr; // GOOD
|
||||
}
|
||||
|
||||
bool in_range(Q *ptr, Q *ptr_end, size_t a) {
|
||||
return a < ptr_end - ptr; // GOOD
|
||||
}
|
||||
Reference in New Issue
Block a user