Skip to content

Commit 5a1dc61

Browse files
authored
modify arguments check logic
As far as I can tell, root cause of double-fetech issue is read from the same user mode memory twice, so it makes sense that only check whether user mode pointer is same or not
1 parent 6a6cd61 commit 5a1dc61

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

cpp/ql/src/experimental/Security/CWE/CWE-362/double-fetch.ql

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,18 @@ class CopyFromUserFunctionCall extends FunctionCall {
2323
not this.getArgument(1) instanceof AddressOfExpr
2424
}
2525

26-
predicate hasSameArguments(CopyFromUserFunctionCall another) {
27-
globalValueNumber(this.getArgument(0)) = globalValueNumber(another.getArgument(0)) and
26+
//root cause of double-fetech issue is read from
27+
//the same user mode memory twice, so it makes
28+
//sense that only check user mode pointer
29+
predicate readFromSameUserModePointer(CopyFromUserFunctionCall another) {
2830
globalValueNumber(this.getArgument(1)) = globalValueNumber(another.getArgument(1))
2931
}
3032
}
3133

3234
from CopyFromUserFunctionCall p1, CopyFromUserFunctionCall p2
3335
where
3436
not p1 = p2 and
35-
p1.hasSameArguments(p2) and
37+
p1.readFromSameUserModePointer(p2) and
3638
exists(IfStmt ifStmt |
3739
p1.getBasicBlock().getAFalseSuccessor*() = ifStmt.getBasicBlock() and
3840
ifStmt.getBasicBlock().getAFalseSuccessor*() = p2.getBasicBlock()

0 commit comments

Comments
 (0)