hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

CPP: Unify and improve the MallocCall classes.

Browse Source
This commit is contained in:
Geoffrey White
2019-04-18 09:51:35 +01:00
parent 1ba8364c3b
commit ca6ba36d87
5 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cpp/ql/src/Critical/OverflowCalculated.ql
View File

@@ -13,7 +13,10 @@ import cpp
class MallocCall extends FunctionCall
{
MallocCall() { this.getTarget().hasQualifiedName("malloc") }
MallocCall() {
this.getTarget().hasQualifiedName("malloc") or
this.getTarget().hasQualifiedName("std::malloc")
}
Expr getAllocatedSize() {
if this.getArgument(0) instanceof VariableAccess then

8
cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql
View File

@@ -15,8 +15,12 @@
*/
import cpp
class MallocCall extends FunctionCall {
MallocCall() { this.getTarget().hasGlobalName("malloc") }
class MallocCall extends FunctionCall
{
MallocCall() {
this.getTarget().hasQualifiedName("malloc") or
this.getTarget().hasQualifiedName("std::malloc")
}
Expr getAllocatedSize() {
if this.getArgument(0) instanceof VariableAccess then

2
cpp/ql/test/query-tests/Critical/OverflowCalculated/NoSpaceForZeroTerminator.expected
View File

@@ -1,3 +1,5 @@
| tests1.cpp:26:21:26:26 | call to malloc | This allocation does not include space to null-terminate the string. |
| tests1.cpp:67:21:67:26 | call to malloc | This allocation does not include space to null-terminate the string. |
| tests1.cpp:89:25:89:30 | call to malloc | This allocation does not include space to null-terminate the string. |
| tests3.cpp:25:21:25:31 | call to malloc | This allocation does not include space to null-terminate the string. |
| tests3.cpp:30:21:30:31 | call to malloc | This allocation does not include space to null-terminate the string. |

2
cpp/ql/test/query-tests/Critical/OverflowCalculated/OverflowCalculated.expected
View File

@@ -2,3 +2,5 @@
| tests1.cpp:67:21:67:26 | call to malloc | This allocation does not include space to null-terminate the string. |
| tests1.cpp:89:25:89:30 | call to malloc | This allocation does not include space to null-terminate the string. |
| tests2.cpp:34:4:34:9 | call to strcat | This buffer only contains enough room for 'str1' (copied on line 33) |
| tests3.cpp:25:21:25:31 | call to malloc | This allocation does not include space to null-terminate the string. |
| tests3.cpp:30:21:30:31 | call to malloc | This allocation does not include space to null-terminate the string. |

4
cpp/ql/test/query-tests/Critical/OverflowCalculated/tests3.cpp
View File

@@ -22,12 +22,12 @@ void tests3(int case_num)
switch (case_num)
{
case 1:
buffer = (char *)std::malloc(strlen(str3global)); // BAD [NOT DETECTED]
buffer = (char *)std::malloc(strlen(str3global)); // BAD
strcpy(buffer, str3global);
break;
case 2:
buffer = (char *)std::malloc(strlen(str3local)); // BAD [NOT DETECTED]
buffer = (char *)std::malloc(strlen(str3local)); // BAD
strcpy(buffer, str3local);
break;