mirror of
https://github.com/github/codeql.git
synced 2025-12-17 09:13:20 +01:00
51 lines
1.7 KiB
C
51 lines
1.7 KiB
C
/* Semmle test case for OverflowStatic.ql
|
|
Associated with CWE-131 http://cwe.mitre.org/data/definitions/131.html
|
|
Each query is expected to find exactly the lines marked BAD in the section corresponding to it.
|
|
*/
|
|
|
|
///// Library functions //////
|
|
|
|
|
|
typedef struct {} FILE;
|
|
|
|
typedef unsigned long size_t;
|
|
typedef void *va_list;
|
|
|
|
int sprintf(char *s, const char *format, ...);
|
|
int snprintf(char *s, size_t n, const char *format, ...);
|
|
char *fgets(char *s, int n, FILE *stream);
|
|
char *strncpy(char *s1, const char *s2, size_t n);
|
|
char *strncat(char *s1, const char *s2, size_t n);
|
|
void *memcpy(void *s1, const void *s2, size_t n);
|
|
void *memmove(void *s1, const void *s2, size_t n);
|
|
size_t fread(void *ptr, size_t size, size_t nmemb, FILE *stream);
|
|
|
|
//// Test code /////
|
|
|
|
void bad0(char *src, FILE *f, va_list ap) {
|
|
char buffer[40];
|
|
|
|
fgets(buffer, 41, f); // BAD: Too many characters read
|
|
strncpy(buffer, src, 43); // BAD: Too many characters copied
|
|
buffer[0] = 0;
|
|
strncat(buffer, src, 44); // BAD: Too many characters copied
|
|
memcpy(buffer, src, 45); // BAD: Too many characters copied
|
|
memmove(buffer, src, 46); // BAD: Too many characters copied
|
|
snprintf(buffer, 47, "%s", src); // BAD: Too many characters copied
|
|
vsnprintf(buffer, 48, "%s", ap); // BAD: Too many characters copied
|
|
}
|
|
|
|
void good0(char *src, FILE *f, va_list ap) {
|
|
char buffer[60];
|
|
fread(buffer, sizeof(char), 51, f); // GOOD
|
|
fgets(buffer, 52, f); // GOOD
|
|
strncpy(buffer, src, 53); // GOOD
|
|
buffer[0] = 0;
|
|
strncat(buffer, src, 54); // GOOD
|
|
memcpy(buffer, src, 55); // GOOD
|
|
memmove(buffer, src, 56); // GOOD
|
|
snprintf(buffer, 57, "%s", src); // GOOD
|
|
vsnprintf(buffer, 58, "%s", ap); // GOOD
|
|
}
|
|
|