hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 18:25:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #923 from geoffw0/potentialbufferoverflow

Browse Source 
CPP: Deprecate PotentialBufferOverflow.ql
This commit is contained in:
Jonas Jensen
2019-03-04 08:11:27 +00:00
committed by GitHub
parent b8f8ed55e6 25a5ff5e55
commit c49c23068a
16 changed files with 35 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWrite.expected Normal file
View File

@@ -0,0 +1,4 @@
| tests.cpp:258:2:258:8 | call to sprintf | This 'call to sprintf' operation requires 17 bytes but the destination is only 10 bytes. |
| tests.cpp:259:2:259:8 | call to sprintf | This 'call to sprintf' operation requires 17 bytes but the destination is only 10 bytes. |
| tests.cpp:272:2:272:8 | call to sprintf | This 'call to sprintf' operation requires 9 bytes but the destination is only 8 bytes. |
| tests.cpp:273:2:273:8 | call to sprintf | This 'call to sprintf' operation requires 9 bytes but the destination is only 8 bytes. |

1
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWrite.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE/CWE-120/OverrunWrite.ql

1
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWriteFloat.expected Normal file
View File

@@ -0,0 +1 @@
| tests.cpp:287:2:287:8 | call to sprintf | This 'call to sprintf' operation may require 318 bytes because of float conversions, but the target is only 64 bytes. |

1
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWriteFloat.qlref Normal file
View File

@@ -0,0 +1 @@
Security/CWE/CWE-120/OverrunWriteFloat.ql

4
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/PotentialBufferOverflow.expected
View File

@@ -1,4 +0,0 @@
| tests.cpp:258:2:258:8 | call to sprintf | This conversion may yield a string of length 17, which exceeds the allocated buffer size of 10 |
| tests.cpp:259:2:259:8 | call to sprintf | This conversion may yield a string of length 17, which exceeds the allocated buffer size of 10 |
| tests.cpp:272:2:272:8 | call to sprintf | This conversion may yield a string of length 9, which exceeds the allocated buffer size of 8 |
| tests.cpp:273:2:273:8 | call to sprintf | This conversion may yield a string of length 9, which exceeds the allocated buffer size of 8 |

1
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/PotentialBufferOverflow.qlref
View File

@@ -1 +0,0 @@
Likely Bugs/Memory Management/PotentialBufferOverflow.ql

17
cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/tests.cpp
View File

@@ -272,3 +272,20 @@ void test4()
sprintf(buffer8, "12345678"); // BAD: buffer overflow
sprintf(buffer8_ptr, "12345678"); // BAD: buffer overflow
}
typedef void *va_list;
int vsprintf(char *s, const char *format, va_list arg);
void test5(va_list args, float f)
{
char buffer10[10], buffer64[64];
char *buffer4 = new char[4 * sizeof(char)];
vsprintf(buffer10, "123456789", args); // GOOD
vsprintf(buffer10, "1234567890", args); // BAD: buffer overflow [NOT DETECTED]
sprintf(buffer64, "%f", f); // BAD: potential buffer overflow
vsprintf(buffer4, "123", args); // GOOD
vsprintf(buffer4, "1234", args); // BAD: buffer overflow [NOT DETECTED]
}