codeql/cpp/ql/lib/semmle/code/cpp/security/BufferAccess.qll

import cpp

/**
 * Returns the size of the pointed-to type, counting void types as size 1.
 */
int getPointedSize(Type t) {
  result = t.getUnspecifiedType().(PointerType).getBaseType().getSize().maximum(1)
}

/**
 * An operation that reads data from or writes data to a buffer.
 *
 * See the BufferWrite class for an explanation of how BufferAccess and
 * BufferWrite differ.
 */
abstract class BufferAccess extends Expr {
  BufferAccess() {
    not this.isUnevaluated() and
    //A buffer access must be reachable (not in dead code)
    reachable(this)
  }

  abstract string getName();

  /**
   * Gets the expression that denotes the buffer, along with a textual label
   * for it and an access type.
   *
   * accessType:
   * - 1 = buffer range [0, getSize) is accessed entirely.
   * - 2 = buffer range [0, getSize) may be accessed partially or entirely.
   * - 3 = buffer is accessed at offset getSize - 1.
   * - 4 = buffer is accessed with null terminator read protections
   *       (does not read past null terminator, regardless of access size)
   */
  abstract Expr getBuffer(string bufferDesc, int accessType);

  /**
   * Gets the expression that represents the size of the buffer access. The
   * actual size is typically the value of this expression multiplied by the
   * result of `getSizeMult()`, in bytes.
   */
  Expr getSizeExpr() { none() }

  /**
   * Gets a constant multiplier for the buffer access size given by
   * `getSizeExpr`, in bytes.
   */
  int getSizeMult() { none() }

  /**
   * Gets the buffer access size in bytes.
   */
  int getSize() { result = this.getSizeExpr().getValue().toInt() * this.getSizeMult() }
}

/**
 * Calls to memcpy and similar functions.
 *  memcpy(dest, src, num)
 *  wmemcpy(dest, src, num)
 *  memmove(dest, src, num)
 *  wmemmove(dest, src, num)
 *  mempcpy(dest, src, num)
 *  wmempcpy(dest, src, num)
 *  RtlCopyMemoryNonTemporal(dest, src, num)
 */
class MemcpyBA extends BufferAccess {
  MemcpyBA() {
    this.(FunctionCall).getTarget().getName() =
      [
        "memcpy", "wmemcpy", "memmove", "wmemmove", "mempcpy", "wmempcpy",
        "RtlCopyMemoryNonTemporal"
      ]
  }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "destination buffer" and
    accessType = 1
    or
    result = this.(FunctionCall).getArgument(1) and
    bufferDesc = "source buffer" and
    accessType = 1
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(2) }

  override int getSizeMult() {
    result = getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
  }
}

/**
 * Calls to bcopy.
 *  bcopy(src, dest, num)
 */
class BCopyBA extends BufferAccess {
  BCopyBA() { this.(FunctionCall).getTarget().getName() = "bcopy" }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "source buffer" and
    accessType = 1
    or
    result = this.(FunctionCall).getArgument(1) and
    bufferDesc = "destination buffer" and
    accessType = 1
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(2) }

  override int getSizeMult() {
    result = getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
  }
}

/**
 * Calls to strncpy.
 *  strncpy(dest, src, num)
 */
class StrncpyBA extends BufferAccess {
  StrncpyBA() { this.(FunctionCall).getTarget().getName() = "strncpy" }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "destination buffer" and
    accessType = 2
    or
    result = this.(FunctionCall).getArgument(1) and
    bufferDesc = "source buffer" and
    accessType = 4
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(2) }

  override int getSizeMult() {
    result = getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
  }
}

/**
 * Calls to memccpy.
 *  memccpy(dest, src, c, n)
 */
class MemccpyBA extends BufferAccess {
  MemccpyBA() { this.(FunctionCall).getTarget().getName() = "memccpy" }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "destination buffer" and
    accessType = 2
    or
    result = this.(FunctionCall).getArgument(1) and
    bufferDesc = "source buffer" and
    accessType = 2
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(3) }

  override int getSizeMult() {
    result = getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
  }
}

/**
 * Calls to memcmp and similar functions.
 *  memcmp(buffer1, buffer2, num)
 *  wmemcmp(buffer1, buffer2, num)
 *  _memicmp(buffer1, buffer2, count)
 *  _memicmp_l(buffer1, buffer2, count, locale)
 */
class MemcmpBA extends BufferAccess {
  MemcmpBA() {
    this.(FunctionCall).getTarget().getName() = ["memcmp", "wmemcmp", "_memicmp", "_memicmp_l"]
  }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "first buffer" and
    accessType = 2
    or
    result = this.(FunctionCall).getArgument(1) and
    bufferDesc = "second buffer" and
    accessType = 2
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(2) }

  override int getSizeMult() {
    result = getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
  }
}

/**
 * Calls to swab and similar functions.
 *  swab(src, dest, num)
 *  _swab(src, dest, num)
 */
class SwabBA extends BufferAccess {
  SwabBA() { this.(FunctionCall).getTarget().getName() = ["swab", "_swab"] }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "source buffer" and
    accessType = 1
    or
    result = this.(FunctionCall).getArgument(1) and
    bufferDesc = "destination buffer" and
    accessType = 1
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(2) }

  override int getSizeMult() {
    result = getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
  }
}

/**
 * Calls to memset and similar functions.
 *  memset(dest, value, num)
 *  wmemset(dest, value, num)
 */
class MemsetBA extends BufferAccess {
  MemsetBA() { this.(FunctionCall).getTarget().getName() = ["memset", "wmemset"] }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "destination buffer" and
    accessType = 1
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(2) }

  override int getSizeMult() {
    result = getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
  }
}

/**
 * Calls to `RtlSecureZeroMemory`.
 *  RtlSecureZeroMemory(ptr, cnt)
 */
class ZeroMemoryBA extends BufferAccess {
  ZeroMemoryBA() { this.(FunctionCall).getTarget().getName() = "RtlSecureZeroMemory" }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "destination buffer" and
    accessType = 1
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(1) }

  override int getSizeMult() { result = 1 }
}

/**
 * Calls to memchr and similar functions.
 *  memchr(buffer, value, num)
 *  wmemchr(buffer, value, num)
 */
class MemchrBA extends BufferAccess {
  MemchrBA() { this.(FunctionCall).getTarget().getName() = ["memchr", "wmemchr"] }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "source buffer" and
    accessType = 2
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(2) }

  override int getSizeMult() {
    result = getPointedSize(this.(FunctionCall).getTarget().getParameter(0).getType())
  }
}

/**
 * Calls to fread.
 *  fread(buffer, size, number, file)
 */
class FreadBA extends BufferAccess {
  FreadBA() { this.(FunctionCall).getTarget().getName() = "fread" }

  override string getName() { result = this.(FunctionCall).getTarget().getName() }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(FunctionCall).getArgument(0) and
    bufferDesc = "destination buffer" and
    accessType = 2
  }

  override Expr getSizeExpr() { result = this.(FunctionCall).getArgument(1) }

  override int getSizeMult() { result = this.(FunctionCall).getArgument(2).getValue().toInt() }
}

/**
 * A array access on a buffer:
 *  buffer[ix]
 * but not:
 *  &buffer[ix]
 */
class ArrayExprBA extends BufferAccess, ArrayExpr {
  ArrayExprBA() {
    not exists(AddressOfExpr aoe | aoe.getAChild() = this) and
    // exclude accesses in macro implementation of `strcmp`,
    // which are carefully controlled but can look dangerous.
    not exists(Macro m |
      m.getName() = "strcmp" and
      m.getAnInvocation().getAnExpandedElement() = this
    )
  }

  override string getName() { result = "array indexing" }

  override Expr getBuffer(string bufferDesc, int accessType) {
    result = this.(ArrayExpr).getArrayBase() and
    bufferDesc = "array" and
    accessType = 3
  }

  override Expr getSizeExpr() { result = this.(ArrayExpr).getArrayOffset() }

  override int getSize() {
    // byte size of the buffer that would be required to support this
    // access
    result = (1 + this.getSizeExpr().getValue().toInt()) * this.getSizeMult()
  }

  override int getSizeMult() { result = this.(ArrayExpr).getType().getSize() }
}