hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-21 23:14:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

add tests for brotli

Browse Source
This commit is contained in:
am0o0
2024-09-03 12:28:06 +02:00
parent 49eaaf55a5
commit e85ca79d77
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs.expected
View File

@@ -1,4 +1,6 @@
edges
| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | provenance | |
| brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | provenance | TaintFunction |
| zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:63:25:63:35 | *a | provenance | |
| zlibTest.cpp:63:25:63:35 | *a | zlibTest.cpp:52:25:52:25 | *a | provenance | |
| zlibTest.cpp:63:25:63:35 | *a | zlibTest.cpp:69:17:69:26 | & ... | provenance | Config |
@@ -45,6 +47,9 @@ edges
| zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument | zlibTest.cpp:174:19:174:66 | *access to array | provenance | |
| zlibTest.cpp:174:19:174:66 | *access to array | zlibTest.cpp:156:41:156:45 | *input | provenance | |
nodes
| brotliTest.cpp:29:32:29:35 | **argv | semmle.label | **argv |
| brotliTest.cpp:31:42:31:60 | *access to array | semmle.label | *access to array |
| brotliTest.cpp:37:35:37:40 | *input2 | semmle.label | *input2 |
| zlibTest.cpp:52:25:52:25 | *a | semmle.label | *a |
| zlibTest.cpp:52:25:52:25 | *a | semmle.label | *a |
| zlibTest.cpp:63:25:63:35 | *a | semmle.label | *a |
@@ -86,6 +91,8 @@ subpaths
| zlibTest.cpp:171:19:171:25 | *access to array | zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:52:25:52:25 | *a | zlibTest.cpp:171:19:171:25 | UnsafeInflate output argument |
| zlibTest.cpp:172:18:172:24 | *access to array | zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:93:24:93:31 | *fileName | zlibTest.cpp:172:18:172:24 | UnsafeGzread output argument |
#select
| brotliTest.cpp:31:42:31:60 | *access to array | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:31:42:31:60 | *access to array | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| brotliTest.cpp:37:35:37:40 | *input2 | brotliTest.cpp:29:32:29:35 | **argv | brotliTest.cpp:37:35:37:40 | *input2 | This Decompression output $@. | brotliTest.cpp:29:32:29:35 | **argv | is not limited |
| zlibTest.cpp:70:13:70:22 | & ... | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:70:13:70:22 | & ... | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
| zlibTest.cpp:101:32:101:38 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:101:32:101:38 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |
| zlibTest.cpp:121:38:121:44 | inFileZ | zlibTest.cpp:168:27:168:30 | **argv | zlibTest.cpp:121:38:121:44 | inFileZ | This Decompression output $@. | zlibTest.cpp:168:27:168:30 | **argv | is not limited |

41
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/brotliTest.cpp Normal file
View File

@@ -0,0 +1,41 @@
typedef long unsigned int size_t;
typedef unsigned char uint8_t;
typedef enum {
} BrotliDecoderResult;
BrotliDecoderResult BrotliDecoderDecompress(
size_t encoded_size,
const uint8_t encoded_buffer[],
size_t *decoded_size,
uint8_t decoded_buffer[]) { return static_cast<BrotliDecoderResult>(0); };
struct {
} BrotliDecoderStateStruct;
void strncpy(char *string, const char *string1, int i);
typedef struct BrotliDecoderStateStruct BrotliDecoderState;
BrotliDecoderResult BrotliDecoderDecompressStream(
BrotliDecoderState *state, size_t *available_in, const uint8_t **next_in,
size_t *available_out, uint8_t **next_out, size_t *total_out) { return static_cast<BrotliDecoderResult>(0); };
namespace std {
void strncpy(char *string, const char *string1, int i) {
}
}
int main(int argc, const char *argv[]) {
uint8_t *output = nullptr;
BrotliDecoderDecompress(1024 * 1024, (uint8_t *) argv[2],
reinterpret_cast<size_t *>(1024 * 1024 * 1024), output);
uint8_t **output2 = nullptr;
const uint8_t **input2 = nullptr;
std::strncpy(reinterpret_cast<char *>(input2), argv[2], 32);
BrotliDecoderDecompressStream(0, reinterpret_cast<size_t *>(1024 * 1024),
input2, reinterpret_cast<size_t *>(1024 * 1024 * 1024),
output2,
reinterpret_cast<size_t *>(1024 * 1024 * 1024));
return 0;
}