C++: fix implicit this

This commit is contained in:
Erik Krogh Kristensen
2021-10-14 09:49:53 +02:00
committed by Mathias Vorreiter Pedersen
parent b2e4276bc8
commit fe891746bf
97 changed files with 1739 additions and 1571 deletions

View File

@@ -77,21 +77,21 @@ abstract class BufferWrite extends Expr {
* much smaller (8 bytes) than their true maximum length. This can be
* helpful in determining the cause of a buffer overflow issue.
*/
int getMaxDataLimited() { result = getMaxData() }
int getMaxDataLimited() { result = this.getMaxData() }
/**
* Gets the size of a single character of the type this
* operation works with, in bytes.
*/
int getCharSize() {
result = getBufferType().(PointerType).getBaseType().getSize() or
result = getBufferType().(ArrayType).getBaseType().getSize()
result = this.getBufferType().(PointerType).getBaseType().getSize() or
result = this.getBufferType().(ArrayType).getBaseType().getSize()
}
/**
* Gets a description of this buffer write.
*/
string getBWDesc() { result = toString() }
string getBWDesc() { result = this.toString() }
}
/**
@@ -109,7 +109,7 @@ abstract class BufferWriteCall extends BufferWrite, FunctionCall { }
class StrCopyBW extends BufferWriteCall {
StrcpyFunction f;
StrCopyBW() { getTarget() = f.(TopLevelFunction) }
StrCopyBW() { this.getTarget() = f.(TopLevelFunction) }
/**
* Gets the index of the parameter that is the maximum size of the copy (in characters).
@@ -122,21 +122,22 @@ class StrCopyBW extends BufferWriteCall {
int getParamSrc() { result = f.getParamSrc() }
override Type getBufferType() {
result = this.getTarget().getParameter(getParamSrc()).getUnspecifiedType()
result = this.getTarget().getParameter(this.getParamSrc()).getUnspecifiedType()
}
override Expr getASource() { result = getArgument(getParamSrc()) }
override Expr getASource() { result = this.getArgument(this.getParamSrc()) }
override Expr getDest() { result = getArgument(f.getParamDest()) }
override Expr getDest() { result = this.getArgument(f.getParamDest()) }
override predicate hasExplicitLimit() { exists(getParamSize()) }
override predicate hasExplicitLimit() { exists(this.getParamSize()) }
override int getExplicitLimit() {
result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()
}
override int getMaxData() {
result = getArgument(getParamSrc()).(AnalysedString).getMaxLength() * getCharSize()
result =
this.getArgument(this.getParamSrc()).(AnalysedString).getMaxLength() * this.getCharSize()
}
}
@@ -146,7 +147,7 @@ class StrCopyBW extends BufferWriteCall {
class StrCatBW extends BufferWriteCall {
StrcatFunction f;
StrCatBW() { getTarget() = f.(TopLevelFunction) }
StrCatBW() { this.getTarget() = f.(TopLevelFunction) }
/**
* Gets the index of the parameter that is the maximum size of the copy (in characters).
@@ -159,21 +160,22 @@ class StrCatBW extends BufferWriteCall {
int getParamSrc() { result = f.getParamSrc() }
override Type getBufferType() {
result = this.getTarget().getParameter(getParamSrc()).getUnspecifiedType()
result = this.getTarget().getParameter(this.getParamSrc()).getUnspecifiedType()
}
override Expr getASource() { result = getArgument(getParamSrc()) }
override Expr getASource() { result = this.getArgument(this.getParamSrc()) }
override Expr getDest() { result = getArgument(f.getParamDest()) }
override Expr getDest() { result = this.getArgument(f.getParamDest()) }
override predicate hasExplicitLimit() { exists(getParamSize()) }
override predicate hasExplicitLimit() { exists(this.getParamSize()) }
override int getExplicitLimit() {
result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()
}
override int getMaxData() {
result = getArgument(getParamSrc()).(AnalysedString).getMaxLength() * getCharSize()
result =
this.getArgument(this.getParamSrc()).(AnalysedString).getMaxLength() * this.getCharSize()
}
}
@@ -184,7 +186,7 @@ class SprintfBW extends BufferWriteCall {
FormattingFunction f;
SprintfBW() {
exists(string name | f = getTarget().(TopLevelFunction) and name = f.getName() |
exists(string name | f = this.getTarget().(TopLevelFunction) and name = f.getName() |
/*
* C sprintf variants:
*/
@@ -229,19 +231,19 @@ class SprintfBW extends BufferWriteCall {
result = this.(FormattingFunctionCall).getFormatArgument(_)
}
override Expr getDest() { result = getArgument(f.getOutputParameterIndex(false)) }
override Expr getDest() { result = this.getArgument(f.getOutputParameterIndex(false)) }
override int getMaxData() {
exists(FormatLiteral fl |
fl = this.(FormattingFunctionCall).getFormat() and
result = fl.getMaxConvertedLength() * getCharSize()
result = fl.getMaxConvertedLength() * this.getCharSize()
)
}
override int getMaxDataLimited() {
exists(FormatLiteral fl |
fl = this.(FormattingFunctionCall).getFormat() and
result = fl.getMaxConvertedLengthLimited() * getCharSize()
result = fl.getMaxConvertedLengthLimited() * this.getCharSize()
)
}
}
@@ -251,7 +253,7 @@ class SprintfBW extends BufferWriteCall {
*/
class SnprintfBW extends BufferWriteCall {
SnprintfBW() {
exists(TopLevelFunction fn, string name | fn = getTarget() and name = fn.getName() |
exists(TopLevelFunction fn, string name | fn = this.getTarget() and name = fn.getName() |
/*
* C snprintf variants:
*/
@@ -326,25 +328,25 @@ class SnprintfBW extends BufferWriteCall {
result = this.(FormattingFunctionCall).getFormatArgument(_)
}
override Expr getDest() { result = getArgument(0) }
override Expr getDest() { result = this.getArgument(0) }
override predicate hasExplicitLimit() { exists(getParamSize()) }
override predicate hasExplicitLimit() { exists(this.getParamSize()) }
override int getExplicitLimit() {
result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()
}
override int getMaxData() {
exists(FormatLiteral fl |
fl = this.(FormattingFunctionCall).getFormat() and
result = fl.getMaxConvertedLength() * getCharSize()
result = fl.getMaxConvertedLength() * this.getCharSize()
)
}
override int getMaxDataLimited() {
exists(FormatLiteral fl |
fl = this.(FormattingFunctionCall).getFormat() and
result = fl.getMaxConvertedLengthLimited() * getCharSize()
result = fl.getMaxConvertedLengthLimited() * this.getCharSize()
)
}
}
@@ -354,7 +356,7 @@ class SnprintfBW extends BufferWriteCall {
*/
class GetsBW extends BufferWriteCall {
GetsBW() {
getTarget().(TopLevelFunction).getName() =
this.getTarget().(TopLevelFunction).getName() =
[
"gets", // gets(dst)
"fgets", // fgets(dst, max_amount, src_stream)
@@ -365,24 +367,24 @@ class GetsBW extends BufferWriteCall {
/**
* Gets the index of the parameter that is the maximum number of characters to be read.
*/
int getParamSize() { exists(getArgument(1)) and result = 1 }
int getParamSize() { exists(this.getArgument(1)) and result = 1 }
override Type getBufferType() { result = this.getTarget().getParameter(0).getUnspecifiedType() }
override Expr getASource() {
if exists(getArgument(2))
then result = getArgument(2)
if exists(this.getArgument(2))
then result = this.getArgument(2)
else
// the source is input inside the 'gets' call itself
result = this
}
override Expr getDest() { result = getArgument(0) }
override Expr getDest() { result = this.getArgument(0) }
override predicate hasExplicitLimit() { exists(getParamSize()) }
override predicate hasExplicitLimit() { exists(this.getParamSize()) }
override int getExplicitLimit() {
result = getArgument(getParamSize()).getValue().toInt() * getCharSize()
result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()
}
}
@@ -438,7 +440,7 @@ class ScanfBW extends BufferWrite {
exists(ScanfFunctionCall fc, ScanfFormatLiteral fl, int arg |
this = fc.getArgument(arg) and
fl = fc.getFormat() and
result = (fl.getMaxConvertedLength(arg - getParamArgs()) + 1) * getCharSize() // +1 is for the terminating null
result = (fl.getMaxConvertedLength(arg - this.getParamArgs()) + 1) * this.getCharSize() // +1 is for the terminating null
)
}
@@ -463,14 +465,14 @@ private int path_max() {
class RealpathBW extends BufferWriteCall {
RealpathBW() {
exists(path_max()) and // Ignore realpath() calls if PATH_MAX cannot be determined
getTarget().hasGlobalName("realpath") // realpath(path, resolved_path);
this.getTarget().hasGlobalName("realpath") // realpath(path, resolved_path);
}
override Type getBufferType() { result = this.getTarget().getParameter(0).getUnspecifiedType() }
override Expr getDest() { result = getArgument(1) }
override Expr getDest() { result = this.getArgument(1) }
override Expr getASource() { result = getArgument(0) }
override Expr getASource() { result = this.getArgument(0) }
override int getMaxData() {
result = path_max() and

View File

@@ -52,9 +52,9 @@ class BasicOStreamClass extends Type {
*/
class BasicOStreamCall extends FunctionCall {
BasicOStreamCall() {
if getTarget() instanceof MemberFunction
then getQualifier().getType() instanceof BasicOStreamClass
else getArgument(0).getType() instanceof BasicOStreamClass
if this.getTarget() instanceof MemberFunction
then this.getQualifier().getType() instanceof BasicOStreamClass
else this.getArgument(0).getType() instanceof BasicOStreamClass
}
}
@@ -77,10 +77,10 @@ abstract class ChainedOutputCall extends BasicOStreamCall {
*/
Expr getEndDest() {
// recurse into the destination
result = getDest().(ChainedOutputCall).getEndDest()
result = this.getDest().(ChainedOutputCall).getEndDest()
or
// or return something other than a ChainedOutputCall
result = getDest() and
result = this.getDest() and
not result instanceof ChainedOutputCall
}
}
@@ -89,18 +89,18 @@ abstract class ChainedOutputCall extends BasicOStreamCall {
* A call to `operator<<` on an output stream.
*/
class OperatorLShiftCall extends ChainedOutputCall {
OperatorLShiftCall() { getTarget().(Operator).hasName("operator<<") }
OperatorLShiftCall() { this.getTarget().(Operator).hasName("operator<<") }
override Expr getSource() {
if getTarget() instanceof MemberFunction
then result = getArgument(0)
else result = getArgument(1)
if this.getTarget() instanceof MemberFunction
then result = this.getArgument(0)
else result = this.getArgument(1)
}
override Expr getDest() {
if getTarget() instanceof MemberFunction
then result = getQualifier()
else result = getArgument(0)
if this.getTarget() instanceof MemberFunction
then result = this.getQualifier()
else result = this.getArgument(0)
}
}
@@ -108,22 +108,22 @@ class OperatorLShiftCall extends ChainedOutputCall {
* A call to 'put'.
*/
class PutFunctionCall extends ChainedOutputCall {
PutFunctionCall() { getTarget().(MemberFunction).hasName("put") }
PutFunctionCall() { this.getTarget().(MemberFunction).hasName("put") }
override Expr getSource() { result = getArgument(0) }
override Expr getSource() { result = this.getArgument(0) }
override Expr getDest() { result = getQualifier() }
override Expr getDest() { result = this.getQualifier() }
}
/**
* A call to 'write'.
*/
class WriteFunctionCall extends ChainedOutputCall {
WriteFunctionCall() { getTarget().(MemberFunction).hasName("write") }
WriteFunctionCall() { this.getTarget().(MemberFunction).hasName("write") }
override Expr getSource() { result = getArgument(0) }
override Expr getSource() { result = this.getArgument(0) }
override Expr getDest() { result = getQualifier() }
override Expr getDest() { result = this.getQualifier() }
}
/**

View File

@@ -24,7 +24,7 @@ private class RemoteReturnSource extends RemoteFlowSource {
RemoteReturnSource() {
exists(RemoteFlowSourceFunction func, CallInstruction instr, FunctionOutput output |
asInstruction() = instr and
this.asInstruction() = instr and
instr.getStaticCallTarget() = func and
func.hasRemoteFlowSource(output, sourceType) and
(
@@ -43,7 +43,7 @@ private class RemoteParameterSource extends RemoteFlowSource {
RemoteParameterSource() {
exists(RemoteFlowSourceFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
asInstruction() = instr and
this.asInstruction() = instr and
instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
func.hasRemoteFlowSource(output, sourceType) and
output.isParameterDerefOrQualifierObject(instr.getIndex())
@@ -58,7 +58,7 @@ private class LocalReturnSource extends LocalFlowSource {
LocalReturnSource() {
exists(LocalFlowSourceFunction func, CallInstruction instr, FunctionOutput output |
asInstruction() = instr and
this.asInstruction() = instr and
instr.getStaticCallTarget() = func and
func.hasLocalFlowSource(output, sourceType) and
(
@@ -77,7 +77,7 @@ private class LocalParameterSource extends LocalFlowSource {
LocalParameterSource() {
exists(LocalFlowSourceFunction func, WriteSideEffectInstruction instr, FunctionOutput output |
asInstruction() = instr and
this.asInstruction() = instr and
instr.getPrimaryInstruction().(CallInstruction).getStaticCallTarget() = func and
func.hasLocalFlowSource(output, sourceType) and
output.isParameterDerefOrQualifierObject(instr.getIndex())

View File

@@ -77,7 +77,7 @@ abstract class FunctionWithWrappers extends Function {
) {
// base case
func = this and
interestingArg(paramIndex) and
this.interestingArg(paramIndex) and
callChain = toCause(func, paramIndex) and
depth = 0
or
@@ -101,7 +101,7 @@ abstract class FunctionWithWrappers extends Function {
private predicate wrapperFunctionAnyDepth(Function func, int paramIndex, string cause) {
// base case
func = this and
interestingArg(paramIndex) and
this.interestingArg(paramIndex) and
cause = toCause(func, paramIndex)
or
// recursive step
@@ -147,7 +147,7 @@ abstract class FunctionWithWrappers extends Function {
)
or
not this.wrapperFunctionLimitedDepth(func, paramIndex, _, _) and
cause = wrapperFunctionAnyDepthUnique(func, paramIndex)
cause = this.wrapperFunctionAnyDepthUnique(func, paramIndex)
}
/**

View File

@@ -78,7 +78,7 @@ class SecurityOptions extends string {
functionCall.getTarget().getName() = fname and
(
fname = ["fgets", "gets"] or
userInputReturn(fname)
this.userInputReturn(fname)
)
)
or

View File

@@ -29,7 +29,7 @@ private predicate suspicious(string s) {
*/
class SensitiveVariable extends Variable {
SensitiveVariable() {
suspicious(getName().toLowerCase()) and
suspicious(this.getName().toLowerCase()) and
not this.getUnspecifiedType() instanceof IntegralType
}
}
@@ -39,7 +39,7 @@ class SensitiveVariable extends Variable {
*/
class SensitiveFunction extends Function {
SensitiveFunction() {
suspicious(getName().toLowerCase()) and
suspicious(this.getName().toLowerCase()) and
not this.getUnspecifiedType() instanceof IntegralType
}
}

View File

@@ -113,7 +113,7 @@ module BoostorgAsio {
result.getName() = "tls_server"
)
or
result = getASslv23ProtocolConstant()
result = this.getASslv23ProtocolConstant()
}
/**