hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 12:16:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>
This commit is contained in:
ihsinme
2022-03-01 10:49:36 +03:00
committed by GitHub
parent 0c8a07218c
commit d772ea0efe
3 changed files with 12 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
cpp/ql/src/experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.cpp
View File

@@ -1,10 +1,10 @@
... ...
r = scanf("%i", i); r = scanf("%i", &i);
if (r == 1) // GOOD if (r == 1) // GOOD
return i; return i;
else else
return -1; return -1;
... ...
scanf("%i", i); // BAD scanf("%i", &i); // BAD
return i; return i;
... ...

12
cpp/ql/src/experimental/Security/CWE/CWE-754/ImproperCheckReturnValueScanf.ql
View File

@@ -1,5 +1,5 @@
/** /**
* @name Improper check return value scanf. * @name Improper check return value scanf
* @description Using a function call without the ability to evaluate the correctness of the work can lead to unexpected results. * @description Using a function call without the ability to evaluate the correctness of the work can lead to unexpected results.
* @kind problem * @kind problem
* @id cpp/improper-check-return-value-scanf * @id cpp/improper-check-return-value-scanf
@@ -15,20 +15,16 @@ import cpp
import semmle.code.cpp.commons.Exclusions import semmle.code.cpp.commons.Exclusions
import semmle.code.cpp.valuenumbering.GlobalValueNumbering import semmle.code.cpp.valuenumbering.GlobalValueNumbering
/** Returns the starting position of the argument being filled. */ /** Returns the position of the first argument being filled. */
int posArgumentInFunctionCall(FunctionCall fc) { int posArgumentInFunctionCall(FunctionCall fc) {
( (
( (
fc.getTarget().hasGlobalOrStdName("scanf") or fc.getTarget().hasGlobalOrStdName(["scanf", "scanf_s"])
fc.getTarget().hasGlobalOrStdName("scanf_s")
) and ) and
result = 1 result = 1
or or
( (
fc.getTarget().hasGlobalOrStdName("fscanf") or fc.getTarget().hasGlobalOrStdName(["fscanf", "sscanf", "fscanf_s", "sscanf_s"])
fc.getTarget().hasGlobalOrStdName("sscanf") or
fc.getTarget().hasGlobalOrStdName("fscanf_s") or
fc.getTarget().hasGlobalOrStdName("sscanf_s")
) and ) and
result = 2 result = 2
) )

12
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-754/semmle/tests/test.cpp
View File

@@ -2,7 +2,7 @@ int scanf(const char *format, ...);
int globalVal; int globalVal;
int functionWork1() { int functionWork1() {
int i; int i;
if (scanf("%i", i) == 1) // GOOD if (scanf("%i", &i) == 1) // GOOD
return i; return i;
else else
return -1; return -1;
@@ -11,7 +11,7 @@ int functionWork1() {
int functionWork1_() { int functionWork1_() {
int i; int i;
int r; int r;
r = scanf("%i", i); r = scanf("%i", &i);
if (r == 1) // GOOD if (r == 1) // GOOD
return i; return i;
else else
@@ -20,25 +20,25 @@ int functionWork1_() {
int functionWork1b() { int functionWork1b() {
int i; int i;
scanf("%i", i); // BAD scanf("%i", &i); // BAD
return i; return i;
} }
int functionWork2() { int functionWork2() {
int i = 0; int i = 0;
scanf("%i", i); // GOOD:the error can be determined by examining the initial value. scanf("%i", &i); // GOOD:the error can be determined by examining the initial value.
return i; return i;
} }
int functionWork2_() { int functionWork2_() {
int i; int i;
i = 0; i = 0;
scanf("%i", i); // GOOD:the error can be determined by examining the initial value. scanf("%i", &i); // GOOD:the error can be determined by examining the initial value.
return i; return i;
} }
int functionWork2b() { int functionWork2b() {
int i; int i;
scanf("%i", i); // BAD scanf("%i", &i); // BAD
globalVal = i; globalVal = i;
return 0; return 0;
} }