hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 05:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: fix cxartesian product in constant off-by-one query

Browse Source
This commit is contained in:
Robert Marsh
2023-05-19 18:32:09 -04:00
committed by Robert Marsh
parent 584adf843a
commit bf07b0f97b
2 changed files with 38 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
View File

@@ -87,6 +87,18 @@ predicate pointerArithOverflow(
delta = bound - size
}
module PointerArithmeticToDerefConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
pointerArithOverflow(source.asInstruction(), _, _, _, _)
}
predicate isSink(DataFlow::Node sink) {
isInvalidPointerDerefSink1(sink, _, _)
}
}
module PointerArithmeticToDerefFlow = DataFlow::Global<PointerArithmeticToDerefConfig>;
module FieldAddressToDerefConfig implements DataFlow::StateConfigSig {
newtype FlowState =
additional TArray(Field f) { pointerArithOverflow(_, f, _, _, _) } or
@@ -101,9 +113,12 @@ module FieldAddressToDerefConfig implements DataFlow::StateConfigSig {
)
}
pragma[inline]
predicate isSink(DataFlow::Node sink, FlowState state) {
isInvalidPointerDerefSink1(sink, _, _) and
state instanceof TOverflowArithmetic
exists(DataFlow::Node pai |
state = TOverflowArithmetic(pai.asInstruction()) and
PointerArithmeticToDerefFlow::flow(pai, sink)
)
}
predicate isBarrier(DataFlow::Node node, FlowState state) { none() }