hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-23 20:26:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update IfStatementAdditionOverflow.ql

Browse Source
This commit is contained in:
Nicky Mouha
2023-02-21 18:11:22 -05:00
committed by GitHub
parent f577a04eab
commit ed75172bdd
1 changed files with 25 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
cpp/ql/src/experimental/Security/CWE/CWE-190/IfStatementAdditionOverflow.ql
View File

@@ -1,13 +1,13 @@
/** /**
* @name Integer addition may overflow inside condition * @name Integer addition may overflow inside if statement
* @description Detects "c-b" when the condition "a+b>c" has been imposed, * @description Detects "if (a+b>c) a=c-b", which incorrectly implements
* which is not the same as the condition "a>b-c" if "a+b" * a = min(a,c-b) if a+b overflows. Should be replaced by
* overflows. Rewriting improves readability and optimizability * "if (a>c-b) a=c-b". Also detects "if (b+a>c) a=c-b"
* (CSE elimination). Also detects "b+a>c" (swapped terms in * (swapped terms in addition), if (a+b>c) { a=c-b }"
* addition), "c<a+b" (swapped operands), and ">=", "<", * (assignment inside block), "c<a+b" (swapped operands) and
* "<=" instead of ">" (all operators). This integer overflow * ">=", "<", "<=" instead of ">" (all operators). This
* is the root cause of the buffer overflow in the SHA-3 * integer overflow is the root cause of the buffer overflow
* reference implementation (CVE-2022-37454). * in the SHA-3 reference implementation (CVE-2022-37454).
* @kind problem * @kind problem
* @problem.severity warning * @problem.severity warning
* @id cpp/if-statement-addition-overflow * @id cpp/if-statement-addition-overflow
@@ -18,19 +18,27 @@
*/ */
import cpp import cpp
import semmle.code.cpp.controlflow.Guards
import semmle.code.cpp.valuenumbering.GlobalValueNumbering import semmle.code.cpp.valuenumbering.GlobalValueNumbering
import semmle.code.cpp.valuenumbering.HashCons
import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
import semmle.code.cpp.commons.Exclusions import semmle.code.cpp.commons.Exclusions
from GuardCondition guard, BasicBlock block, RelationalOperation relop, AddExpr addexpr, SubExpr subexpr from IfStmt ifstmt, RelationalOperation relop, ExprStmt exprstmt, BlockStmt blockstmt, AssignExpr assignexpr, AddExpr addexpr, SubExpr subexpr
where guard.controls(block, _) and where ifstmt.getCondition() = relop and
guard.getAChild*() = relop and
pragma[only_bind_into](block) = subexpr.getBasicBlock() and
relop.getAnOperand() = addexpr and relop.getAnOperand() = addexpr and
addexpr.getUnspecifiedType() instanceof IntegralType and addexpr.getUnspecifiedType() instanceof IntegralType and
subexpr.getUnspecifiedType() instanceof IntegralType and
not isFromMacroDefinition(relop) and not isFromMacroDefinition(relop) and
exprMightOverflowPositively(addexpr) and exprMightOverflowPositively(addexpr) and
globalValueNumber(addexpr.getAnOperand()) = globalValueNumber(subexpr.getRightOperand()) and (ifstmt.getThen() = exprstmt or
globalValueNumber(relop.getAnOperand()) = globalValueNumber(subexpr.getLeftOperand()) (ifstmt.getThen() = blockstmt and
select guard, "Integer addition may overflow inside condition." blockstmt.getAStmt() = exprstmt)) and
exprstmt.getExpr() = assignexpr and
assignexpr.getRValue() = subexpr and
((hashCons(addexpr.getLeftOperand()) = hashCons(assignexpr.getLValue()) and
globalValueNumber(addexpr.getRightOperand()) = globalValueNumber(subexpr.getRightOperand())) or
(hashCons(addexpr.getRightOperand()) = hashCons(assignexpr.getLValue()) and
globalValueNumber(addexpr.getLeftOperand()) = globalValueNumber(subexpr.getRightOperand()))) and
globalValueNumber(relop.getAnOperand()) = globalValueNumber(subexpr.getLeftOperand()) and
not globalValueNumber(addexpr.getAnOperand()) = globalValueNumber(relop.getAnOperand())
select ifstmt, "Integer addition may overflow inside if statement."