mirror of
https://github.com/github/codeql.git
synced 2025-12-18 18:10:39 +01:00
61 lines
1.2 KiB
C
61 lines
1.2 KiB
C
/* Semmle test case for SizeCheck.ql
|
|
Associated with CWE-131 http://cwe.mitre.org/data/definitions/131.html
|
|
Each query is expected to find exactly the lines marked BAD in the section corresponding to it.
|
|
*/
|
|
|
|
///// Library functions //////
|
|
|
|
typedef unsigned long size_t;
|
|
void *malloc(size_t size);
|
|
void free(void *ptr);
|
|
|
|
//// Test code /////
|
|
|
|
void bad0(void) {
|
|
|
|
float *fptr = malloc(3); // BAD -- Too small
|
|
double *dptr = malloc(5); // BAD -- Too small
|
|
free(fptr);
|
|
free(dptr);
|
|
}
|
|
|
|
void good0(void) {
|
|
|
|
float *fptr = malloc(4); // GOOD -- Correct size
|
|
double *dptr = malloc(8); // GOOD -- Correct size
|
|
free(fptr);
|
|
free(dptr);
|
|
}
|
|
|
|
void bad1(void) {
|
|
|
|
float *fptr = malloc(sizeof(short)); // BAD -- Too small
|
|
double *dptr = malloc(sizeof(float)); // BAD -- Too small
|
|
free(fptr);
|
|
free(dptr);
|
|
}
|
|
|
|
void good1(void) {
|
|
|
|
float *fptr = malloc(sizeof(float)); // GOOD -- Correct size
|
|
double *dptr = malloc(sizeof(double)); // GOOD -- Correct size
|
|
free(fptr);
|
|
free(dptr);
|
|
}
|
|
|
|
typedef struct _myStruct
|
|
{
|
|
int x, y;
|
|
} MyStruct;
|
|
|
|
typedef union _myUnion
|
|
{
|
|
MyStruct ms;
|
|
char data[128];
|
|
} MyUnion;
|
|
|
|
void test_union() {
|
|
MyUnion *a = malloc(sizeof(MyUnion)); // GOOD
|
|
MyUnion *b = malloc(sizeof(MyStruct)); // BAD (too small)
|
|
}
|