hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add taint tests for strlen.

Browse Source
This commit is contained in:
Geoffrey White
2020-05-29 09:25:32 +01:00
parent 688f540843
commit d77092c931
4 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
cpp/ql/test/library-tests/dataflow/taint-tests/format.cpp
View File

@@ -136,3 +136,24 @@ void test1()
sink(buffer); // tainted [NOT DETECTED]
}
}
// ----------
size_t strlen(const char *s);
size_t wcslen(const wchar_t *s);
void test2()
{
char *s = string::source();
wchar_t *ws = wstring::source();
int i;
sink(strlen(s)); // [FALSE POSITIVE]
sink(wcslen(ws)); // [FALSE POSITIVE]
i = strlen(s) + 1;
sink(i); // [FALSE POSITIVE]
sink(s[strlen(s) - 1]); // tainted
sink(ws + (wcslen(ws) / 2)); // tainted
}

25
cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected
View File

@@ -111,6 +111,31 @@
| format.cpp:135:39:135:45 | ref arg & ... | format.cpp:135:40:135:45 | buffer [inner post update] | |
| format.cpp:135:39:135:45 | ref arg & ... | format.cpp:136:8:136:13 | buffer | |
| format.cpp:135:40:135:45 | buffer | format.cpp:135:39:135:45 | & ... | |
| format.cpp:147:12:147:25 | call to source | format.cpp:151:14:151:14 | s | |
| format.cpp:147:12:147:25 | call to source | format.cpp:154:13:154:13 | s | |
| format.cpp:147:12:147:25 | call to source | format.cpp:157:7:157:7 | s | |
| format.cpp:147:12:147:25 | call to source | format.cpp:157:16:157:16 | s | |
| format.cpp:148:16:148:30 | call to source | format.cpp:152:14:152:15 | ws | |
| format.cpp:148:16:148:30 | call to source | format.cpp:158:7:158:8 | ws | |
| format.cpp:148:16:148:30 | call to source | format.cpp:158:20:158:21 | ws | |
| format.cpp:151:14:151:14 | s | format.cpp:151:7:151:12 | call to strlen | TAINT |
| format.cpp:152:14:152:15 | ws | format.cpp:152:7:152:12 | call to wcslen | TAINT |
| format.cpp:154:6:154:11 | call to strlen | format.cpp:154:6:154:18 | ... + ... | TAINT |
| format.cpp:154:6:154:18 | ... + ... | format.cpp:154:2:154:18 | ... = ... | |
| format.cpp:154:6:154:18 | ... + ... | format.cpp:155:7:155:7 | i | |
| format.cpp:154:13:154:13 | s | format.cpp:154:6:154:11 | call to strlen | TAINT |
| format.cpp:154:18:154:18 | 1 | format.cpp:154:6:154:18 | ... + ... | TAINT |
| format.cpp:157:7:157:7 | s | format.cpp:157:7:157:22 | access to array | TAINT |
| format.cpp:157:9:157:14 | call to strlen | format.cpp:157:9:157:21 | ... - ... | TAINT |
| format.cpp:157:9:157:21 | ... - ... | format.cpp:157:7:157:22 | access to array | TAINT |
| format.cpp:157:16:157:16 | s | format.cpp:157:9:157:14 | call to strlen | TAINT |
| format.cpp:157:21:157:21 | 1 | format.cpp:157:9:157:21 | ... - ... | TAINT |
| format.cpp:158:7:158:8 | ws | format.cpp:158:7:158:27 | ... + ... | TAINT |
| format.cpp:158:7:158:27 | ref arg ... + ... | format.cpp:158:7:158:8 | ws [inner post update] | |
| format.cpp:158:13:158:18 | call to wcslen | format.cpp:158:13:158:26 | ... / ... | TAINT |
| format.cpp:158:13:158:26 | ... / ... | format.cpp:158:7:158:27 | ... + ... | TAINT |
| format.cpp:158:20:158:21 | ws | format.cpp:158:13:158:18 | call to wcslen | TAINT |
| format.cpp:158:26:158:26 | 2 | format.cpp:158:13:158:26 | ... / ... | TAINT |
| stl.cpp:67:12:67:17 | call to source | stl.cpp:71:7:71:7 | a | |
| stl.cpp:68:16:68:20 | 123 | stl.cpp:68:16:68:21 | call to basic_string | TAINT |
| stl.cpp:68:16:68:21 | call to basic_string | stl.cpp:72:7:72:7 | b | |

5
cpp/ql/test/library-tests/dataflow/taint-tests/taint.expected
View File

@@ -8,6 +8,11 @@
| format.cpp:100:8:100:13 | buffer | format.cpp:99:30:99:43 | call to source |
| format.cpp:105:8:105:13 | buffer | format.cpp:104:31:104:45 | call to source |
| format.cpp:110:8:110:14 | wbuffer | format.cpp:109:38:109:52 | call to source |
| format.cpp:151:7:151:12 | call to strlen | format.cpp:147:12:147:25 | call to source |
| format.cpp:152:7:152:12 | call to wcslen | format.cpp:148:16:148:30 | call to source |
| format.cpp:155:7:155:7 | i | format.cpp:147:12:147:25 | call to source |
| format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
| format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
| stl.cpp:71:7:71:7 | a | stl.cpp:67:12:67:17 | call to source |
| stl.cpp:73:7:73:7 | c | stl.cpp:69:16:69:21 | call to source |
| stl.cpp:75:9:75:13 | call to c_str | stl.cpp:69:16:69:21 | call to source |

6
cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected
View File

@@ -1,3 +1,9 @@
| format.cpp:151:7:151:12 | call to strlen | format.cpp:147:12:147:25 | call to source |
| format.cpp:152:7:152:12 | call to wcslen | format.cpp:148:16:148:30 | call to source |
| format.cpp:155:7:155:7 | i | format.cpp:147:12:147:25 | call to source |
| format.cpp:157:7:157:22 | (int)... | format.cpp:147:12:147:25 | call to source |
| format.cpp:157:7:157:22 | access to array | format.cpp:147:12:147:25 | call to source |
| format.cpp:158:7:158:27 | ... + ... | format.cpp:148:16:148:30 | call to source |
| stl.cpp:71:7:71:7 | (const char *)... | stl.cpp:67:12:67:17 | call to source |
| stl.cpp:71:7:71:7 | a | stl.cpp:67:12:67:17 | call to source |
| taint.cpp:8:8:8:13 | clean1 | taint.cpp:4:27:4:33 | source1 |