hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add files via upload

Browse Source
This commit is contained in:
ihsinme
2021-04-26 23:05:08 +03:00
committed by GitHub
parent b7de370918
commit c31a761750
2 changed files with 85 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/DoubleFree.expected
View File

@@ -1,2 +1,4 @@
| test.c:9:8:9:10 | buf | This pointer may be cleared again later. |
| test.c:19:26:19:29 | buf1 | This pointer may be cleared again later. |
| test.c:11:16:11:18 | buf | This pointer may have already been cleared in the line 10. |
| test.c:18:8:18:10 | buf | This pointer may have already been cleared in the line 17. |
| test.c:57:8:57:10 | buf | This pointer may have already been cleared in the line 55. |
| test.c:78:8:78:10 | buf | This pointer may have already been cleared in the line 77. |

87
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-415/semmle/tests/test.c
View File

@@ -1,21 +1,96 @@
typedef unsigned long size_t;
void *malloc(size_t size);
void free(void *ptr);
#define NULL 0
void workFunction_0(char *s) {
int intSize = 10;
char *buf;
buf = (char *) malloc(intSize);
free(buf); // BAD
if(buf) free(buf);
free(buf); // GOOD
if(buf) free(buf); // BAD
}
void workFunction_1(char *s) {
int intSize = 10;
char *buf;
buf = (char *) malloc(intSize);
free(buf); // GOOD
free(buf); // BAD
}
void workFunction_2(char *s) {
int intSize = 10;
char *buf;
buf = (char *) malloc(intSize);
free(buf); // GOOD
buf = NULL;
free(buf);
}
void workFunction_3(char *s) {
int intSize = 10;
char *buf;
int intFlag;
buf = (char *) malloc(intSize);
if(buf[1]%5) {
free(buf);
buf = NULL;
}
free(buf);
}
void workFunction_4(char *s) {
int intSize = 10;
char *buf;
char *tmpbuf;
tmpbuf = (char *) malloc(intSize);
buf = (char *) malloc(intSize);
free(buf); // GOOD
buf = tmpbuf;
free(buf); // GOOD
}
void workFunction_5(char *s) {
int intSize = 10;
char *buf;
int intFlag;
buf = (char *) malloc(intSize);
if(intFlag) {
free(buf);
}
free(buf); // BAD
}
void workFunction_6(char *s) {
int intSize = 10;
char *buf;
char *tmpbuf;
int intFlag;
tmpbuf = (char *) malloc(intSize);
buf = (char *) malloc(intSize);
if(intFlag) {
free(buf);
buf = tmpbuf;
}
free(buf);
}
void workFunction_7(char *s) {
int intSize = 10;
char *buf;
char *buf1;
buf = (char *) malloc(intSize);
buf1 = (char *) realloc(buf,intSize*2);
if(buf) free(buf); // GOOD
buf = (char *) realloc(buf1,intSize*4); // BAD
free(buf1);
buf1 = (char *) realloc(buf,intSize*4);
free(buf); // BAD
}
void workFunction_8(char *s) {
int intSize = 10;
char *buf;
char *buf1;
buf = (char *) malloc(intSize);
buf1 = (char *) realloc(buf,intSize*4);
if(!buf1)
free(buf); // GOOD
}
void workFunction_9(char *s) {
int intSize = 10;
char *buf;
char *buf1;
buf = (char *) malloc(intSize);
if(!(buf1 = (char *) realloc(buf,intSize*4)))
free(buf); // GOOD
}