hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 01:03:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #293 from geoffw0/zerosizebuffer

Browse Source 
CPP: Better handling of zero-sized buffers
This commit is contained in:
Jonas Jensen
2018-11-06 20:08:39 +01:00
committed by GitHub
parent 33c02fe928 698f8953c7
commit e03b4f0cb6
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
change-notes/1.19/analysis-cpp.md
View File

@@ -28,3 +28,4 @@
* Added a hash consing library for structural comparison of expressions. * Added a hash consing library for structural comparison of expressions.
* `getBufferSize` now detects variable size structs more reliably. * `getBufferSize` now detects variable size structs more reliably.
* Buffer.qll now treats arrays of zero size as a special case.

8
cpp/ql/src/Likely Bugs/Memory Management/StrncpyFlippedArgs.ql
View File

@@ -104,9 +104,13 @@ where
// Some of the functions operate on a larger char type, like `wchar_t`, so we // Some of the functions operate on a larger char type, like `wchar_t`, so we
// need to take this into account in the fixed size case. // need to take this into account in the fixed size case.
charSize = f.getParameter(argDest).getType().getUnspecifiedType().(PointerType).getBaseType().getSize() and charSize = f.getParameter(argDest).getType().getUnspecifiedType().(PointerType).getBaseType().getSize() and
if exists (fc.getArgument(argLimit).getValue().toInt()) then ( if exists(fc.getArgument(argLimit).getValue().toInt()) then (
// Fixed sized case // Fixed sized case
arrayExprFixedSize(copyDest) < charSize * fc.getArgument(argLimit).getValue().toInt() exists(int size |
size = arrayExprFixedSize(copyDest) and
size < charSize * fc.getArgument(argLimit).getValue().toInt() and
size != 0 // if the array has zero size, something special is going on
)
) else exists (Access takenSizeOf, BufferSizeExpr sizeExpr, int plus | ) else exists (Access takenSizeOf, BufferSizeExpr sizeExpr, int plus |
// Variable sized case // Variable sized case
sizeExpr = fc.getArgument(argLimit).getAChild*() and sizeExpr = fc.getArgument(argLimit).getAChild*() and

4
cpp/ql/src/semmle/code/cpp/commons/Buffer.qll
View File

@@ -57,7 +57,9 @@ int getBufferSize(Expr bufferExpr, Element why) {
// buffer is a fixed size array // buffer is a fixed size array
result = bufferVar.getType().getUnspecifiedType().(ArrayType).getSize() and result = bufferVar.getType().getUnspecifiedType().(ArrayType).getSize() and
why = bufferVar and why = bufferVar and
not memberMayBeVarSize(_, bufferVar) not memberMayBeVarSize(_, bufferVar) and
not result = 0 // zero sized arrays are likely to have special usage, for example
// behaving a bit like a 'union' overlapping other fields.
) or ( ) or (
// buffer is an initialized array // buffer is an initialized array
// e.g. int buffer[] = {1, 2, 3}; // e.g. int buffer[] = {1, 2, 3};