codeql/cpp/ql/test/query-tests/Likely Bugs/Memory Management/ImproperNullTermination/test.cpp

typedef unsigned int size_t;
typedef signed int ssize_t;
typedef struct {} FILE;

size_t strlen(const char *s);
char *strcpy(char *s1, const char *s2);
char *strcat(char *s1, const char *s2);
char *strdup(const char *s1);
void *malloc(size_t size);
void *memset(void *s, int c, size_t n);
void *memcpy(void *s1, const void *s2, size_t n);
void read(int src, void *out, int num);
size_t fread(void *ptr, size_t size, size_t nmemb, FILE *stream);
ssize_t readlink(const char *path, char *buffer, size_t buffer_size);
ssize_t readlinkat(int fd, const char *path, char *buffer, size_t buffer_size);

bool cond();

void test_unassigned()
{
	{
		char buffer1[1024];
		char buffer2[1024];

		strdup(buffer1); // BAD
		strdup(buffer2); // BAD

		memcpy(buffer2, buffer1, sizeof(buffer2));
		strdup(buffer1); // BAD [NOT DETECTED]
		strdup(buffer2); // BAD [NOT DETECTED]
	}

	{
		char buffer1[1024];
		char buffer2[1024];

		strcpy(buffer1, "content");
		strdup(buffer1); // GOOD
		strdup(buffer2); // BAD

		memcpy(buffer2, buffer1, sizeof(buffer2));
		strdup(buffer1); // GOOD
		strdup(buffer2); // GOOD
	}

	{
		char buffer1[1024] = {0};
		char buffer2[1024];

		memset(buffer2, 0, sizeof(buffer2));
		strdup(buffer1); // GOOD
		strdup(buffer2); // GOOD
	}

	{
		char *ptr1;
		char *ptr2 = "content";

		strdup(ptr1); // BAD
		strdup(ptr2); // GOOD
	}

	{
		char buffer1[1024];
		char buffer2[1024];
		char *ptr;

		ptr = buffer1;
		strdup(buffer1); // BAD
		strdup(ptr); // BAD

		strcpy(buffer1, "content");
		strdup(buffer1); // GOOD
		strdup(ptr); // GOOD

		ptr = buffer1;
		strdup(buffer1); // GOOD
		strdup(ptr); // GOOD

		ptr = buffer2;
		strdup(buffer2); // BAD
		strdup(ptr); // BAD
	}

	{
		char buffer[1024];

		if (cond())
		{
			strcpy(buffer, "content");
			strdup(buffer); // GOOD
		}
		strdup(buffer); // BAD
	}

	{
		char buffer[1024];

		if (cond())
		{
			strcpy(buffer, "content");
		} else {
			strcpy(buffer, "alternative");
		}
		strdup(buffer); // GOOD
	}

	{
		char buffer[1024];

		while (cond())
		{
			strcpy(buffer, "content");
			strdup(buffer); // GOOD
		}
		strdup(buffer); // BAD
	}
}

void test_callee(char *p1, char *p2)
{
	strdup(p1);
}

void test_caller()
{
	char buffer[1024];

	test_callee("content", buffer); // GOOD
	test_callee(buffer, "content"); // BAD
}

void test_readlink(int fd, const char *path, size_t sz)
{
	{
		char buffer[1024];

		readlink(path, buffer, sizeof(buffer));
		strdup(buffer); // BAD
	}

	{
		char buffer[1024];
		int v;

		readlinkat(fd, path, buffer, sizeof(buffer));
		v = strlen(buffer); // BAD
	}

	{
		char buffer[1024] = {0};

		readlink(path, buffer, sizeof(buffer) - 1);
		strdup(buffer); // GOOD
	}

	{
		char buffer[1024];
		ssize_t len;

		len = readlink(path, buffer, sizeof(buffer));
		if (len >= 0)
		{
			buffer[len - 1] = 0;
			strdup(buffer); // GOOD
		}
	}

	{
		char buffer[1024];

		memset(buffer, 0, sizeof(buffer));
		readlink(path, buffer, sizeof(buffer) - 1);
		strdup(buffer); // GOOD
	}

	{
		char buffer[1024];

		memset(buffer, 0, sizeof(buffer));
		readlink(path, buffer, sizeof(buffer));
		strdup(buffer); // BAD
	}

	{
		char buffer[1024];

		memset(buffer, 0, sizeof(buffer));
		readlink(path, buffer, sizeof(buffer));
		buffer[sizeof(buffer) - 1] = 0;
		strdup(buffer); // GOOD
	}

	{
		char *buffer = (char *)malloc(1024);

		readlink(path, buffer, 1024);
		strdup(buffer); // BAD [NOT DETECTED]
	}

	{
		char *buffer = (char *)malloc(1024);

		buffer[1023] = 0;
		readlink(path, buffer, 1023);
		strdup(buffer); // GOOD
	}

	{
		char *buffer = (char *)malloc(sz);

		readlink(path, buffer, sz);
		strdup(buffer); // BAD [NOT DETECTED]
	}

	{
		char *buffer = (char *)malloc(sz);

		memset(buffer, 0, sz);
		readlink(path, buffer, sz - 1);
		strdup(buffer); // GOOD
	}
}

void doNothing(char *data) { };
void doNothing2(const char *data);
void clearBuffer(char *data, size_t size);

void test_strcat()
{
	{
		char buffer[1024];

		strcat(buffer, "content"); // BAD
	}

	{
		char buffer[1024];

		buffer[0] = 0;
		strcat(buffer, "content"); // GOOD
	}

	{
		char buffer[1024];

		buffer[10] = 0;
		strcat(buffer, "content"); // GOOD
	}

	{
		char buffer[1024];

		buffer[0] = '\0';
		strcat(buffer, "content"); // GOOD
	}

	{
		char buffer[1024];

		buffer[0] = 'a';
		strcat(buffer, "content"); // BAD
	}

	{
		char buffer[1024];

		*buffer = 0;
		strcat(buffer, "content"); // GOOD
	}

	{
		char buffer[1024];

		strcpy(buffer, "con");
		strcat(buffer, "tent"); // GOOD
	}

	{
		char buffer[1024];

		doNothing(buffer);
		strcat(buffer, "content"); // BAD
	}

	{
		char buffer[1024];

		doNothing2(buffer);
		strcat(buffer, "content"); // BAD [NOT DETECTED]
	}

	{
		char buffer1[1024];
		char buffer2[1024];
		char *buffer_ptr = buffer1;

		*buffer_ptr = 0;
		strcat(buffer1, "content"); // GOOD
		strcat(buffer2, "content"); // BAD
		strcat(buffer_ptr, "content"); // GOOD

		buffer_ptr = buffer2;
		strcat(buffer_ptr, "content"); // BAD [NOT DETECTED]
	}

	{
		char buffer[1024];
		char *buffer_ptr = buffer;

		*buffer_ptr = 'a';
		strcat(buffer, "content"); // BAD
	}

	{
		char buffer[1024];

		clearBuffer(buffer, 1024);
		strcat(buffer, "content"); // GOOD
	}
}

void test_strlen(bool cond1, bool cond2)
{
	{
		char buffer[1024];
		int i = strlen(buffer); // BAD
	}

	{
		char buffer[1024] = {0};
		int i = strlen(buffer); // GOOD
	}

	{
		char *ptr = "content";
		int i = strlen(ptr); // GOOD
	}

	{
		char buffer[1024];

		if (cond1)
			buffer[0] = 0;
		if (cond1)
			strlen(buffer); // GOOD [FALSE POSITIVE]
	}

	{
		char buffer[1024];

		if (cond1)
			buffer[0] = 0;
		if (cond2)
			strlen(buffer); // BAD
	}
}

void test_strcpy()
{
	{
		char buffer1[1024];
		char buffer2[1024];

		strcpy(buffer1, buffer2); // BAD
	}

	{
		char buffer1[1024];
		char buffer2[1024];

		strcpy(buffer2, "content"); // GOOD
		strcpy(buffer1, buffer2); // GOOD
	}
}

void strcatWrapper(char *data, const char *with)
{
	strcat(data, with);
}

void strcatWrapper2(char *data, const char *with)
{
	strcatWrapper(data, with);
}

void test_wrappers()
{
	{
		char buffer[1024];

		strcatWrapper(buffer, "content"); // BAD
	}

	{
		char buffer[1024];

		strcatWrapper2(buffer, "content"); // BAD
	}
}

void test_read_fread(int read_src, FILE *s)
{
	const size_t buffer_size = 80;

	{
		char buffer[buffer_size];

		read(read_src, buffer, buffer_size * sizeof(char));
		strlen(buffer); // BAD
	}

	{
		char buffer[buffer_size];

		read(read_src, buffer, buffer_size * sizeof(char));
		buffer[buffer_size - 1] = 0;
		strlen(buffer); // GOOD
	}

	{
		char buffer[buffer_size];

		fread(buffer, sizeof(char), buffer_size, s);
		strlen(buffer); // BAD
	}

	{
		char buffer[buffer_size];

		fread(buffer, sizeof(char), buffer_size, s);
		buffer[buffer_size - 1] = 0;
		strlen(buffer); // GOOD
	}
}

int printf(const char *format, ...);

void test_printf(char *str)
{
	{
		char buffer[1024];

		printf(buffer, ""); // BAD
	}

	{
		char buffer[1024];

		printf("%s", buffer); // BAD
	}

	{
		size_t len = strlen(str);
		char *copied_str = (char *)malloc(len);

		memcpy(copied_str, str, len);
		printf("%s", copied_str); // BAD [NOT DETECTED]
	}

	{
		size_t len = strlen(str);
		char *copied_str = (char *)malloc(len + 1);

		memcpy(copied_str, str, len + 1);
		printf("%s", copied_str); // GOOD
	}
}