hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

CPP: Support crement operations in CWE-190.

Browse Source
This commit is contained in:
Geoffrey White
2018-08-23 10:30:22 +01:00
parent f2760f2547
commit d2fd986f40
4 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql
View File

@@ -21,7 +21,7 @@ predicate taintedVarAccess(Expr origin, VariableAccess va) {
tainted(origin, va)
}
from Expr origin, BinaryArithmeticOperation op, VariableAccess va, string effect
from Expr origin, Operation op, VariableAccess va, string effect
where taintedVarAccess(origin, va)
and op.getAnOperand() = va
and

2
cpp/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
View File

@@ -46,7 +46,7 @@ predicate guardedByAssignDiv(Expr origin) {
tainted(origin, va) and div.getLValue() = va)
}
from Expr origin, BinaryArithmeticOperation op, VariableAccess va, string effect
from Expr origin, Operation op, VariableAccess va, string effect
where taintedVarAccess(origin, va)
and op.getAnOperand() = va
and

2
cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql
View File

@@ -45,7 +45,7 @@ predicate taintedVarAccess(Expr origin, VariableAccess va) {
tainted(origin, va)
}
from Expr origin, BinaryArithmeticOperation op, VariableAccess va, string effect
from Expr origin, Operation op, VariableAccess va, string effect
where taintedVarAccess(origin, va)
and op.getAnOperand() = va
and

16
cpp/ql/src/semmle/code/cpp/security/Overflow.qll
View File

@@ -4,7 +4,7 @@ import semmle.code.cpp.controlflow.Dominance
/* Guarding */
/** is the size of this use guarded using 'abs'? */
predicate guardedAbs(BinaryArithmeticOperation e, Expr use) {
predicate guardedAbs(Operation e, Expr use) {
exists(FunctionCall fc |
fc.getTarget().getName() = "abs" |
fc.getArgument(0).getAChild*() = use
@@ -13,7 +13,7 @@ predicate guardedAbs(BinaryArithmeticOperation e, Expr use) {
}
/** is the size of this use guarded to be less than something? */
predicate guardedLesser(BinaryArithmeticOperation e, Expr use) {
predicate guardedLesser(Operation e, Expr use) {
exists(IfStmt c, RelationalOperation guard |
use = guard.getLesserOperand().getAChild*() and
guard = c.getControllingExpr().getAChild*() and
@@ -33,7 +33,7 @@ predicate guardedLesser(BinaryArithmeticOperation e, Expr use) {
}
/** is the size of this use guarded to be greater than something? */
predicate guardedGreater(BinaryArithmeticOperation e, Expr use) {
predicate guardedGreater(Operation e, Expr use) {
exists(IfStmt c, RelationalOperation guard |
use = guard.getGreaterOperand().getAChild*() and
guard = c.getControllingExpr().getAChild*() and
@@ -58,11 +58,12 @@ VariableAccess varUse(LocalScopeVariable v) {
}
/** is e not guarded against overflow by use? */
predicate missingGuardAgainstOverflow(BinaryArithmeticOperation e, VariableAccess use) {
predicate missingGuardAgainstOverflow(Operation e, VariableAccess use) {
use = e.getAnOperand() and
exists(LocalScopeVariable v | use.getTarget() = v |
// overflow possible if large
(e instanceof AddExpr and not guardedLesser(e, varUse(v))) or
(e instanceof IncrementOperation and not guardedLesser(e, varUse(v))) or
// overflow possible if large or small
(e instanceof MulExpr and
not (guardedLesser(e, varUse(v)) and guardedGreater(e, varUse(v))))
@@ -70,12 +71,13 @@ predicate missingGuardAgainstOverflow(BinaryArithmeticOperation e, VariableAcces
}
/** is e not guarded against underflow by use? */
predicate missingGuardAgainstUnderflow(BinaryArithmeticOperation e, VariableAccess use) {
predicate missingGuardAgainstUnderflow(Operation e, VariableAccess use) {
use = e.getAnOperand() and
exists(LocalScopeVariable v | use.getTarget() = v |
// underflow possible if use is left operand and small
(e instanceof SubExpr and
(use = e.getLeftOperand() and not guardedGreater(e, varUse(v)))) or
(use = e.(SubExpr).getLeftOperand() and not guardedGreater(e, varUse(v))) or
// underflow possible if small
(e instanceof DecrementOperation and not guardedGreater(e, varUse(v))) or
// underflow possible if large or small
(e instanceof MulExpr and
not (guardedLesser(e, varUse(v)) and guardedGreater(e, varUse(v))))