Skip to content

Commit 56eacce

Browse files
rdmarsh2rdmarsh2
committed
C++: restrict to end-of-allocation pointers
1 parent 93de8e2 commit 56eacce

File tree

3 files changed

+18
-36
lines changed

3 files changed

+18
-36
lines changed

‎cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,10 +27,15 @@ class ArraySizeConfiguration extends ProductFlow::Configuration {
2727
pai.getRight() = index and
2828
pai.getLeft() = sink1.asInstruction() and
2929
bounded(index, b, delta, true) and
30-
sink2.asInstruction() = b.getInstruction())
30+
sink2.asInstruction() = b.getInstruction() and
31+
delta >= 0
32+
)
3133
}
3234
}
3335

34-
from ArraySizeConfiguration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2, DataFlow::PathNode sink1, DataFlow2::PathNode sink2
36+
from
37+
ArraySizeConfiguration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2,
38+
DataFlow::PathNode sink1, DataFlow2::PathNode sink2
3539
where conf.hasFlowPath(source1, source2, sink1, sink2)
36-
select source1, source2, sink1, sink2
40+
// TODO: pull delta out and display it
41+
select source1, source2, sink1, sink2

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.expected

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,23 @@
1-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:6:9:6:11 | arr | test.cpp:4:24:4:27 | size |
2-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:6:9:6:11 | arr | test.cpp:4:24:4:27 | size |
3-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:6:9:6:11 | arr | test.cpp:5:25:5:28 | size |
4-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:6:9:6:11 | arr | test.cpp:5:25:5:28 | size |
5-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:6:9:6:11 | arr | test.cpp:9:26:9:29 | size |
61
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | arr | test.cpp:4:24:4:27 | size |
72
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | arr | test.cpp:4:24:4:27 | size |
83
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | arr | test.cpp:5:25:5:28 | size |
94
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | arr | test.cpp:5:25:5:28 | size |
105
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:24:4:27 | size | test.cpp:10:9:10:11 | arr | test.cpp:9:26:9:29 | size |
11-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | size | test.cpp:6:9:6:11 | arr | test.cpp:5:25:5:28 | size |
12-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | size | test.cpp:6:9:6:11 | arr | test.cpp:5:25:5:28 | size |
13-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | size | test.cpp:6:9:6:11 | arr | test.cpp:9:26:9:29 | size |
146
| test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | size | test.cpp:10:9:10:11 | arr | test.cpp:5:25:5:28 | size |
157
| test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | size | test.cpp:10:9:10:11 | arr | test.cpp:5:25:5:28 | size |
168
| test.cpp:4:17:4:22 | call to malloc | test.cpp:5:25:5:28 | size | test.cpp:10:9:10:11 | arr | test.cpp:9:26:9:29 | size |
17-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:9:26:9:29 | size | test.cpp:6:9:6:11 | arr | test.cpp:9:26:9:29 | size |
18-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:9:26:9:29 | size | test.cpp:6:9:6:11 | arr | test.cpp:9:26:9:29 | size |
199
| test.cpp:4:17:4:22 | call to malloc | test.cpp:9:26:9:29 | size | test.cpp:10:9:10:11 | arr | test.cpp:9:26:9:29 | size |
2010
| test.cpp:4:17:4:22 | call to malloc | test.cpp:9:26:9:29 | size | test.cpp:10:9:10:11 | arr | test.cpp:9:26:9:29 | size |
21-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:59:13:59:13 | p | test.cpp:55:5:55:19 | Store |
22-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:59:13:59:13 | p | test.cpp:55:16:55:19 | size |
23-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:59:13:59:13 | p | test.cpp:55:16:55:19 | size |
24-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:59:13:59:13 | p | test.cpp:56:20:56:23 | size |
2511
| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | p | test.cpp:55:5:55:19 | Store |
2612
| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | p | test.cpp:55:16:55:19 | size |
2713
| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | p | test.cpp:55:16:55:19 | size |
2814
| test.cpp:56:13:56:18 | call to malloc | test.cpp:55:16:55:19 | size | test.cpp:63:13:63:13 | p | test.cpp:56:20:56:23 | size |
29-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:56:20:56:23 | size | test.cpp:59:13:59:13 | p | test.cpp:56:20:56:23 | size |
30-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:56:20:56:23 | size | test.cpp:59:13:59:13 | p | test.cpp:56:20:56:23 | size |
3115
| test.cpp:56:13:56:18 | call to malloc | test.cpp:56:20:56:23 | size | test.cpp:63:13:63:13 | p | test.cpp:56:20:56:23 | size |
3216
| test.cpp:56:13:56:18 | call to malloc | test.cpp:56:20:56:23 | size | test.cpp:63:13:63:13 | p | test.cpp:56:20:56:23 | size |
33-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:58:29:58:32 | size | test.cpp:59:13:59:13 | p | test.cpp:58:29:58:32 | size |
34-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:58:29:58:32 | size | test.cpp:59:13:59:13 | p | test.cpp:58:29:58:32 | size |
3517
| test.cpp:56:13:56:18 | call to malloc | test.cpp:58:29:58:32 | size | test.cpp:63:13:63:13 | p | test.cpp:58:29:58:32 | size |
3618
| test.cpp:56:13:56:18 | call to malloc | test.cpp:58:29:58:32 | size | test.cpp:63:13:63:13 | p | test.cpp:58:29:58:32 | size |
37-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:62:30:62:33 | size | test.cpp:59:13:59:13 | p | test.cpp:62:30:62:33 | size |
38-
| test.cpp:56:13:56:18 | call to malloc | test.cpp:62:30:62:33 | size | test.cpp:59:13:59:13 | p | test.cpp:62:30:62:33 | size |
3919
| test.cpp:56:13:56:18 | call to malloc | test.cpp:62:30:62:33 | size | test.cpp:63:13:63:13 | p | test.cpp:62:30:62:33 | size |
4020
| test.cpp:56:13:56:18 | call to malloc | test.cpp:62:30:62:33 | size | test.cpp:63:13:63:13 | p | test.cpp:62:30:62:33 | size |
41-
| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:79:14:79:14 | p | test.cpp:78:30:78:33 | size |
4221
| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:83:14:83:14 | p | test.cpp:82:31:82:34 | size |
43-
| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:89:14:89:14 | p | test.cpp:88:30:88:33 | size |
44-
| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:89:14:89:14 | p | test.cpp:92:31:92:34 | size |
4522
| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:93:14:93:14 | p | test.cpp:88:30:88:33 | size |
4623
| test.cpp:70:14:70:19 | call to malloc | test.cpp:69:17:69:20 | size | test.cpp:93:14:93:14 | p | test.cpp:92:31:92:34 | size |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/test.cpp

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,21 +28,21 @@ void test2(int size) {
2828
array_t arr = mk_array(size);
2929

3030
for (int i = 0; i < arr.size; i++) {
31-
arr.p[i] = 0;
31+
arr.p[i] = 0; // GOOD
3232
}
3333

3434
for (int i = 0; i <= arr.size; i++) {
35-
arr.p[i] = i;
35+
arr.p[i] = i; // BAD
3636
}
3737
}
3838

3939
void test3_callee(array_t arr) {
4040
for (int i = 0; i < arr.size; i++) {
41-
arr.p[i] = 0;
41+
arr.p[i] = 0; // GOOD
4242
}
4343

4444
for (int i = 0; i <= arr.size; i++) {
45-
arr.p[i] = i;
45+
arr.p[i] = i; // BAD
4646
}
4747
}
4848

@@ -56,11 +56,11 @@ void test4(int size) {
5656
arr.p = malloc(size);
5757

5858
for (int i = 0; i < arr.size; i++) {
59-
arr.p[i] = 0;
59+
arr.p[i] = 0; // GOOD
6060
}
6161

6262
for (int i = 0; i <= arr.size; i++) {
63-
arr.p[i] = i;
63+
arr.p[i] = i; // BAD
6464
}
6565
}
6666

@@ -76,21 +76,21 @@ void test5(int size) {
7676
array_t *arr = mk_array_p(size);
7777

7878
for (int i = 0; i < arr->size; i++) {
79-
arr->p[i] = 0;
79+
arr->p[i] = 0; // GOOD
8080
}
8181

8282
for (int i = 0; i <= arr->size; i++) {
83-
arr->p[i] = i;
83+
arr->p[i] = i; // BAD
8484
}
8585
}
8686

8787
void test6_callee(array_t *arr) {
8888
for (int i = 0; i < arr->size; i++) {
89-
arr->p[i] = 0;
89+
arr->p[i] = 0; // GOOD
9090
}
9191

9292
for (int i = 0; i <= arr->size; i++) {
93-
arr->p[i] = i;
93+
arr->p[i] = i; // BAD
9494
}
9595
}
9696

0 commit comments

Comments
 (0)