hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 17:55:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #843 from geoffw0/strtoul

Browse Source 
CPP: Improve ArithmeticTainted.ql
This commit is contained in:
Jonas Jensen
2019-01-31 07:04:17 -08:00
committed by GitHub
parent fc5b9dd55e b0805f8e79
commit be2a480394
4 changed files with 35 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql
View File

@@ -16,18 +16,18 @@ import semmle.code.cpp.security.Overflow
import semmle.code.cpp.security.Security
import semmle.code.cpp.security.TaintTracking
predicate taintedVarAccess(Expr origin, VariableAccess va) {
isUserInput(origin, _) and
tainted(origin, va)
}
from Expr origin, Operation op, VariableAccess va, string effect
where taintedVarAccess(origin, va)
and op.getAnOperand() = va
from Expr origin, Operation op, Expr e, string effect
where isUserInput(origin, _)
and tainted(origin, e)
and op.getAnOperand() = e
and
(
(missingGuardAgainstUnderflow(op, va) and effect = "underflow") or
(missingGuardAgainstOverflow(op, va) and effect = "overflow")
(missingGuardAgainstUnderflow(op, e) and effect = "underflow") or
(missingGuardAgainstOverflow(op, e) and effect = "overflow") or
(not e instanceof VariableAccess and effect = "overflow")
) and (
op instanceof UnaryArithmeticOperation or
op instanceof BinaryArithmeticOperation
)
select va, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
select e, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
origin, "User-provided value"