mirror of
https://github.com/github/codeql.git
synced 2025-12-16 16:53:25 +01:00
432 lines
11 KiB
Rust
432 lines
11 KiB
Rust
|
|
// --- std::alloc ---
|
|
|
|
pub fn test_alloc(mode: i32) {
|
|
let layout = std::alloc::Layout::new::<i64>();
|
|
unsafe {
|
|
let m1 = std::alloc::alloc(layout); // *mut u8
|
|
let m2 = m1 as *mut i64; // *mut i64
|
|
*m2 = 1; // GOOD
|
|
|
|
let v1 = *m1; // GOOD
|
|
let v2 = *m2; // GOOD
|
|
let v3 = std::ptr::read::<u8>(m1); // GOOD
|
|
let v4 = std::ptr::read::<i64>(m2); // GOOD
|
|
println!(" v1 = {v1}");
|
|
println!(" v2 = {v2}");
|
|
println!(" v3 = {v3}");
|
|
println!(" v4 = {v4}");
|
|
|
|
std::alloc::dealloc(m1, layout); // $ Source[rust/access-invalid-pointer]=dealloc
|
|
// (m1, m2 are now dangling)
|
|
|
|
match mode {
|
|
0 => {
|
|
// reads
|
|
let v5 = *m1; // $ Alert[rust/access-invalid-pointer]=dealloc
|
|
let v6 = *m2; // $ MISSING: Alert
|
|
println!(" v5 = {v5} (!)"); // corrupt in practice
|
|
println!(" v6 = {v6} (!)"); // corrupt in practice
|
|
|
|
// test repeat reads (we don't want lots of very similar results for the same dealloc)
|
|
let _v5b = *m1;
|
|
let _v5c = *m1;
|
|
},
|
|
100 => {
|
|
// more reads
|
|
let v7 = std::ptr::read::<u8>(m1); // $ Alert[rust/access-invalid-pointer]=dealloc
|
|
let v8 = std::ptr::read::<i64>(m2); // $ MISSING: Alert
|
|
println!(" v7 = {v7} (!)"); // corrupt in practice
|
|
println!(" v8 = {v8} (!)"); // corrupt in practice
|
|
},
|
|
101 => {
|
|
// writes
|
|
*m1 = 2; // $ Alert[rust/access-invalid-pointer]=dealloc
|
|
*m2 = 3; // $ MISSING: Alert
|
|
},
|
|
102 => {
|
|
// more writes
|
|
std::ptr::write::<u8>(m1, 4); // $ Alert[rust/access-invalid-pointer]=dealloc
|
|
std::ptr::write::<i64>(m2, 5); // $ MISSING: Alert
|
|
},
|
|
_ => {}
|
|
}
|
|
}
|
|
}
|
|
|
|
pub fn test_alloc_array(mode: i32) {
|
|
let layout = std::alloc::Layout::new::<[u8; 10]>();
|
|
unsafe {
|
|
let m1 = std::alloc::alloc(layout);
|
|
let m2 = m1 as *mut [u8; 10];
|
|
(*m2)[0] = 4; // GOOD
|
|
(*m2)[1] = 5; // GOOD
|
|
|
|
let v1 = (*m2)[0]; // GOOD
|
|
let v2 = (*m2)[1]; // GOOD
|
|
println!(" v1 = {v1}");
|
|
println!(" v2 = {v2}");
|
|
|
|
std::alloc::dealloc(m2 as *mut u8, layout); // $ Source[rust/access-invalid-pointer]=dealloc_array
|
|
// m1, m2 are now dangling
|
|
|
|
match mode {
|
|
0 => {
|
|
// read
|
|
let v3 = (*m2)[0]; // $ Alert[rust/access-invalid-pointer]=dealloc_array
|
|
println!(" v3 = {v3} (!)"); // corrupt in practice
|
|
},
|
|
110 => {
|
|
// another read
|
|
let v4 = (*m2)[1]; // $ Alert[rust/access-invalid-pointer]=dealloc_array
|
|
println!(" v4 = {v4} (!)"); // corrupt in practice
|
|
},
|
|
111 => {
|
|
// write
|
|
(*m2)[0] = 3; // $ Alert[rust/access-invalid-pointer]=dealloc_array
|
|
},
|
|
112 => {
|
|
// another write
|
|
(*m2)[1] = 4; // $ Alert[rust/access-invalid-pointer]=dealloc_array
|
|
},
|
|
113 => {
|
|
// more writes
|
|
std::ptr::write::<u8>(m1, 5); // $ MISSING: Alert
|
|
std::ptr::write::<[u8; 10]>(m2, [6; 10]); // $ Alert[rust/access-invalid-pointer]=dealloc_array
|
|
},
|
|
_ => {}
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- libc::malloc ---
|
|
|
|
pub fn test_libc() {
|
|
unsafe {
|
|
let my_ptr = libc::malloc(256) as *mut i64;
|
|
*my_ptr = 10;
|
|
|
|
let v1 = *my_ptr; // GOOD
|
|
println!(" v1 = {v1}");
|
|
|
|
libc::free(my_ptr as *mut libc::c_void); // $ Source[rust/access-invalid-pointer]=free
|
|
// (my_ptr is now dangling)
|
|
|
|
let v2 = *my_ptr; // $ Alert[rust/access-invalid-pointer]=free
|
|
println!(" v2 = {v2} (!)"); // corrupt in practice
|
|
}
|
|
}
|
|
|
|
// --- std::ptr ---
|
|
|
|
pub fn test_ptr_invalid(mode: i32) {
|
|
let p1: *const i64 = std::ptr::dangling(); // $ Source[rust/access-invalid-pointer]=dangling
|
|
let p2: *mut i64 = std::ptr::dangling_mut(); // $ Source[rust/access-invalid-pointer]=dangling_mut
|
|
let p3: *const i64 = std::ptr::null(); // $ Source[rust/access-invalid-pointer]=null
|
|
|
|
if mode == 120 {
|
|
unsafe {
|
|
// (a segmentation fault occurs in the code below)
|
|
let v1 = *p1; // $ Alert[rust/access-invalid-pointer]=dangling
|
|
let v2 = *p2; // $ Alert[rust/access-invalid-pointer]=dangling_mut
|
|
let v3 = *p3; // $ Alert[rust/access-invalid-pointer]=null
|
|
println!(" v1 = {v1} (!)");
|
|
println!(" v2 = {v2} (!)");
|
|
println!(" v3 = {v3} (!)");
|
|
}
|
|
}
|
|
}
|
|
|
|
struct MyObject {
|
|
value: i64
|
|
}
|
|
|
|
impl MyObject {
|
|
fn is_zero(&self) -> bool {
|
|
self.value == 0
|
|
}
|
|
}
|
|
|
|
pub unsafe fn test_ptr_invalid_conditions(mode: i32) {
|
|
let layout = std::alloc::Layout::new::<MyObject>();
|
|
|
|
// --- mutable pointer ---
|
|
|
|
let mut ptr = std::alloc::alloc(layout) as *mut MyObject;
|
|
(*ptr).value = 0; // good
|
|
|
|
if mode == 121 { // (causes a panic below)
|
|
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
|
|
}
|
|
|
|
if ptr.is_null() {
|
|
let v = (*ptr).value; // $ Alert[rust/access-invalid-pointer]
|
|
println!(" cond1 v = {v}");
|
|
} else {
|
|
let v = (*ptr).value; // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - unreachable with null pointer
|
|
println!(" cond2 v = {v}");
|
|
}
|
|
|
|
if mode == 122 { // (causes a panic below)
|
|
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
|
|
}
|
|
|
|
if !(ptr.is_null()) {
|
|
let v = (*ptr).value; // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - unreachable with null pointer
|
|
println!(" cond3 v = {v}");
|
|
} else {
|
|
let v = (*ptr).value; // $ Alert[rust/access-invalid-pointer]
|
|
println!(" cond4 v = {v}");
|
|
}
|
|
|
|
if mode == 123 { // (causes a panic below)
|
|
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
|
|
}
|
|
|
|
if ptr.is_null() || (*ptr).value == 0 { // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - deref is protected by short-circuiting
|
|
println!(" cond5");
|
|
}
|
|
|
|
if ptr.is_null() || (*ptr).is_zero() { // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - deref is protected by short-circuiting
|
|
println!(" cond6");
|
|
}
|
|
|
|
if !ptr.is_null() || (*ptr).value == 0 { // $ Alert[rust/access-invalid-pointer]
|
|
println!(" cond7");
|
|
}
|
|
|
|
if mode == 124 { // (causes a panic below)
|
|
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
|
|
}
|
|
|
|
if ptr.is_null() && (*ptr).is_zero() { // $ Alert[rust/access-invalid-pointer]
|
|
println!(" cond8");
|
|
}
|
|
|
|
if mode == 125 { // (causes a panic below)
|
|
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
|
|
}
|
|
|
|
if (*ptr).is_zero() || ptr.is_null() { // $ Alert[rust/access-invalid-pointer]
|
|
println!(" cond9");
|
|
}
|
|
|
|
// --- immutable pointer ---
|
|
|
|
let const_ptr;
|
|
|
|
if mode == 126 { // (causes a panic below)
|
|
const_ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
|
|
} else {
|
|
const_ptr = std::alloc::alloc(layout) as *mut MyObject;
|
|
(*const_ptr).value = 0; // good
|
|
}
|
|
|
|
if const_ptr.is_null() {
|
|
let v = (*const_ptr).value; // $ Alert[rust/access-invalid-pointer]
|
|
println!(" cond10 v = {v}");
|
|
} else {
|
|
let v = (*const_ptr).value; // $ good - unreachable with null pointer
|
|
println!(" cond11 v = {v}");
|
|
}
|
|
}
|
|
|
|
// --- drop ---
|
|
|
|
struct MyBuffer {
|
|
data: Vec<u8>
|
|
}
|
|
|
|
pub fn test_drop() {
|
|
let my_buffer = MyBuffer { data: vec!(1, 2, 3) };
|
|
let p1 = std::ptr::addr_of!(my_buffer);
|
|
|
|
unsafe {
|
|
let v1 = (*p1).data[0]; // GOOD
|
|
println!(" v1 = {v1}");
|
|
}
|
|
|
|
drop(my_buffer); // explicitly destructs the `my_buffer` variable
|
|
|
|
unsafe {
|
|
let v2 = (*p1).data[0]; // $ MISSING: Alert
|
|
println!(" v2 = {v2} (!)"); // corrupt in practice
|
|
}
|
|
}
|
|
|
|
pub fn test_ptr_drop(mode: i32) {
|
|
let layout = std::alloc::Layout::new::<Vec<i64>>();
|
|
unsafe {
|
|
let p1 = std::alloc::alloc(layout) as *mut Vec<i64>;
|
|
let p2 = p1;
|
|
|
|
*p1 = vec!(1, 2, 3);
|
|
|
|
let v1 = (*p1)[0]; // GOOD
|
|
let v2 = (*p2)[0]; // GOOD
|
|
println!(" v1 = {v1}");
|
|
println!(" v2 = {v2}");
|
|
|
|
std::ptr::drop_in_place(p1); // $ Source[rust/access-invalid-pointer]=drop_in_place
|
|
// explicitly destructs the pointed-to `m2`
|
|
|
|
if mode == 1 {
|
|
let v3 = (*p1)[0]; // $ Alert[rust/access-invalid-pointer]=drop_in_place
|
|
println!(" v3 = {v3} (!)"); // corrupt in practice
|
|
}
|
|
if mode == 130 {
|
|
let v4 = (*p2)[0]; // $ MISSING: Alert
|
|
println!(" v4 = {v4} (!)"); // corrupt in practice
|
|
}
|
|
|
|
let p3 = std::alloc::alloc(layout) as *mut Vec<i64>;
|
|
std::ptr::drop_in_place((*p3).as_mut_ptr()); // GOOD
|
|
}
|
|
}
|
|
|
|
struct MyDropBuffer {
|
|
ptr: *mut u8,
|
|
}
|
|
|
|
impl MyDropBuffer {
|
|
unsafe fn new() -> MyDropBuffer {
|
|
let layout = std::alloc::Layout::from_size_align(1024, 1).unwrap();
|
|
|
|
MyDropBuffer {
|
|
ptr: std::alloc::alloc(layout),
|
|
}
|
|
|
|
// ...
|
|
}
|
|
}
|
|
|
|
impl Drop for MyDropBuffer {
|
|
fn drop(&mut self) {
|
|
let layout = std::alloc::Layout::from_size_align(1024, 1).unwrap();
|
|
|
|
unsafe {
|
|
_ = *self.ptr;
|
|
drop(*self.ptr); // $ MISSING: Source[rust/access-invalid-pointer]=drop
|
|
_ = *self.ptr; // $ MISSING: Alert[rust/access-invalid-pointer]=drop
|
|
std::alloc::dealloc(self.ptr, layout);
|
|
}
|
|
}
|
|
}
|
|
|
|
// --- qhelp examples ---
|
|
|
|
fn do_something(s: &String) {
|
|
println!(" s = {}", s);
|
|
}
|
|
|
|
fn test_qhelp_example_good(ptr: *mut String) {
|
|
unsafe {
|
|
do_something(&*ptr);
|
|
}
|
|
|
|
// ...
|
|
|
|
unsafe {
|
|
std::ptr::drop_in_place(ptr);
|
|
}
|
|
}
|
|
|
|
fn test_qhelp_example_bad(ptr: *mut String) {
|
|
unsafe {
|
|
std::ptr::drop_in_place(ptr); // $ Source[rust/access-invalid-pointer]=drop_in_place
|
|
}
|
|
|
|
// ...
|
|
|
|
unsafe {
|
|
do_something(&*ptr); // $ Alert[rust/access-invalid-pointer]=drop_in_place
|
|
}
|
|
}
|
|
|
|
pub fn test_qhelp_examples() {
|
|
let layout = std::alloc::Layout::new::<[String; 2]>();
|
|
unsafe {
|
|
let ptr = std::alloc::alloc(layout);
|
|
let ptr_s = ptr as *mut [String; 2];
|
|
let ptr1 = &raw mut (*ptr_s)[0];
|
|
let ptr2 = &raw mut (*ptr_s)[1];
|
|
|
|
*ptr1 = String::from("123");
|
|
*ptr2 = String::from("456");
|
|
|
|
test_qhelp_example_good(ptr1);
|
|
|
|
test_qhelp_example_bad(ptr2);
|
|
|
|
std::alloc::dealloc(ptr, layout);
|
|
}
|
|
}
|
|
|
|
// --- Vec ---
|
|
|
|
pub fn test_vec_reserve() {
|
|
let mut vec1 = Vec::<u16>::new();
|
|
vec1.push(100);
|
|
let ptr1 = &raw mut vec1[0];
|
|
|
|
unsafe {
|
|
let v1 = *ptr1;
|
|
println!(" v1 = {}", v1);
|
|
}
|
|
|
|
vec1.reserve(1000); // $ MISSING: Source[rust/access-invalid-pointer]=reserve
|
|
// (may invalidate the pointer)
|
|
|
|
unsafe {
|
|
let v2 = *ptr1; // $ MISSING: Alert[rust/access-invalid-pointer]=reserve
|
|
println!(" v2 = {}", v2); // corrupt in practice
|
|
}
|
|
|
|
// -
|
|
|
|
let mut vec2 = Vec::<u16>::new();
|
|
vec2.push(200);
|
|
let ptr2 = &raw mut vec2[0];
|
|
|
|
unsafe {
|
|
let v3 = *ptr2;
|
|
println!(" v3 = {}", v3);
|
|
}
|
|
|
|
for _i in 0..1000 {
|
|
vec2.push(0); // $ MISSING: Source[rust/access-invalid-pointer]=push
|
|
// (may invalidate the pointer)
|
|
}
|
|
|
|
unsafe {
|
|
let v4 = *ptr2; // $ MISSING: Alert[rust/access-invalid-pointer]=push
|
|
println!(" v4 = {}", v4); // corrupt in practice
|
|
}
|
|
}
|
|
|
|
// --- pointer to reference ---
|
|
|
|
pub fn test_pointer_converted_to_reference() {
|
|
let layout = std::alloc::Layout::new::<u128>();
|
|
let m3;
|
|
|
|
// allocate
|
|
unsafe {
|
|
let m1 = std::alloc::alloc(layout); // *mut u8
|
|
let m2 = m1 as *mut u128; // *mut u128
|
|
m3 = &mut *m2; // &u128
|
|
}
|
|
|
|
*m3 = 1; // GOOD
|
|
println!(" v1 = {}", *m3); // GOOD
|
|
|
|
// free
|
|
unsafe {
|
|
std::alloc::dealloc((&raw mut *m3) as *mut u8, layout); // $ MISSING: Source[rust/access-invalid-pointer]=dealloc
|
|
}
|
|
// (m1, m2, m3 are now dangling)
|
|
|
|
// (this is corrupt in practice)
|
|
println!(" v2 = {} (!)", *m3); // $ MISSING: Alert[rust/access-invalid-pointer]=dealloc
|
|
}
|