Skip to content

Commit 6537c81

Browse files
MathiasVPMathiasVP
committed
C++: Add more CWE-199 tests that allocates memory based on the result of a SubExpr.
1 parent 4ab6767 commit 6537c81

File tree

2 files changed

+107
-0
lines changed

2 files changed

+107
-0
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/OverrunWriteProductFlow.expected

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,26 @@ edges
4343
| test.cpp:137:22:137:27 | FieldAddress indirection | test.cpp:137:22:137:27 | Load |
4444
| test.cpp:141:17:141:19 | Load indirection [string] | test.cpp:141:22:141:27 | FieldAddress indirection |
4545
| test.cpp:141:22:141:27 | FieldAddress indirection | test.cpp:141:22:141:27 | Load |
46+
| test.cpp:147:5:147:34 | Store | test.cpp:147:10:147:15 | Load indirection [post update] [string] |
47+
| test.cpp:147:10:147:15 | Load indirection [post update] [string] | test.cpp:152:13:152:15 | Load indirection [string] |
48+
| test.cpp:147:10:147:15 | Load indirection [post update] [string] | test.cpp:156:13:156:15 | Load indirection [string] |
49+
| test.cpp:147:10:147:15 | Load indirection [post update] [string] | test.cpp:195:17:195:19 | Load indirection [string] |
50+
| test.cpp:147:10:147:15 | Load indirection [post update] [string] | test.cpp:199:17:199:19 | Load indirection [string] |
51+
| test.cpp:147:10:147:15 | Load indirection [post update] [string] | test.cpp:203:17:203:19 | Load indirection [string] |
52+
| test.cpp:147:10:147:15 | Load indirection [post update] [string] | test.cpp:207:17:207:19 | Load indirection [string] |
53+
| test.cpp:147:19:147:24 | call to malloc | test.cpp:147:5:147:34 | Store |
54+
| test.cpp:152:13:152:15 | Load indirection [string] | test.cpp:152:18:152:23 | FieldAddress indirection |
55+
| test.cpp:152:18:152:23 | FieldAddress indirection | test.cpp:152:18:152:23 | Load |
56+
| test.cpp:156:13:156:15 | Load indirection [string] | test.cpp:156:18:156:23 | FieldAddress indirection |
57+
| test.cpp:156:18:156:23 | FieldAddress indirection | test.cpp:156:18:156:23 | Load |
58+
| test.cpp:195:17:195:19 | Load indirection [string] | test.cpp:195:22:195:27 | FieldAddress indirection |
59+
| test.cpp:195:22:195:27 | FieldAddress indirection | test.cpp:195:22:195:27 | Load |
60+
| test.cpp:199:17:199:19 | Load indirection [string] | test.cpp:199:22:199:27 | FieldAddress indirection |
61+
| test.cpp:199:22:199:27 | FieldAddress indirection | test.cpp:199:22:199:27 | Load |
62+
| test.cpp:203:17:203:19 | Load indirection [string] | test.cpp:203:22:203:27 | FieldAddress indirection |
63+
| test.cpp:203:22:203:27 | FieldAddress indirection | test.cpp:203:22:203:27 | Load |
64+
| test.cpp:207:17:207:19 | Load indirection [string] | test.cpp:207:22:207:27 | FieldAddress indirection |
65+
| test.cpp:207:22:207:27 | FieldAddress indirection | test.cpp:207:22:207:27 | Load |
4666
nodes
4767
| test.cpp:16:11:16:21 | VariableAddress indirection [string] | semmle.label | VariableAddress indirection [string] |
4868
| test.cpp:18:5:18:30 | Store | semmle.label | Store |
@@ -90,6 +110,27 @@ nodes
90110
| test.cpp:141:17:141:19 | Load indirection [string] | semmle.label | Load indirection [string] |
91111
| test.cpp:141:22:141:27 | FieldAddress indirection | semmle.label | FieldAddress indirection |
92112
| test.cpp:141:22:141:27 | Load | semmle.label | Load |
113+
| test.cpp:147:5:147:34 | Store | semmle.label | Store |
114+
| test.cpp:147:10:147:15 | Load indirection [post update] [string] | semmle.label | Load indirection [post update] [string] |
115+
| test.cpp:147:19:147:24 | call to malloc | semmle.label | call to malloc |
116+
| test.cpp:152:13:152:15 | Load indirection [string] | semmle.label | Load indirection [string] |
117+
| test.cpp:152:18:152:23 | FieldAddress indirection | semmle.label | FieldAddress indirection |
118+
| test.cpp:152:18:152:23 | Load | semmle.label | Load |
119+
| test.cpp:156:13:156:15 | Load indirection [string] | semmle.label | Load indirection [string] |
120+
| test.cpp:156:18:156:23 | FieldAddress indirection | semmle.label | FieldAddress indirection |
121+
| test.cpp:156:18:156:23 | Load | semmle.label | Load |
122+
| test.cpp:195:17:195:19 | Load indirection [string] | semmle.label | Load indirection [string] |
123+
| test.cpp:195:22:195:27 | FieldAddress indirection | semmle.label | FieldAddress indirection |
124+
| test.cpp:195:22:195:27 | Load | semmle.label | Load |
125+
| test.cpp:199:17:199:19 | Load indirection [string] | semmle.label | Load indirection [string] |
126+
| test.cpp:199:22:199:27 | FieldAddress indirection | semmle.label | FieldAddress indirection |
127+
| test.cpp:199:22:199:27 | Load | semmle.label | Load |
128+
| test.cpp:203:17:203:19 | Load indirection [string] | semmle.label | Load indirection [string] |
129+
| test.cpp:203:22:203:27 | FieldAddress indirection | semmle.label | FieldAddress indirection |
130+
| test.cpp:203:22:203:27 | Load | semmle.label | Load |
131+
| test.cpp:207:17:207:19 | Load indirection [string] | semmle.label | Load indirection [string] |
132+
| test.cpp:207:22:207:27 | FieldAddress indirection | semmle.label | FieldAddress indirection |
133+
| test.cpp:207:22:207:27 | Load | semmle.label | Load |
93134
subpaths
94135
#select
95136
| test.cpp:42:5:42:11 | call to strncpy | test.cpp:18:19:18:24 | call to malloc | test.cpp:42:18:42:23 | Load | This write may overflow $@ by 1 element. | test.cpp:42:18:42:23 | string | string |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-119/test.cpp

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,3 +142,69 @@ void test4(unsigned size, char *buf, unsigned anotherSize) {
142142
}
143143
}
144144

145+
void test5(unsigned size, char *buf, unsigned anotherSize) {
146+
string_t *str = (string_t *) malloc(sizeof(string_t));
147+
str->string = malloc(size - 1);
148+
str->size = size - 1;
149+
150+
strncpy(str->string, buf, str->size); // GOOD
151+
strncpy(str->string, buf, str->size - 1); // GOOD
152+
strncpy(str->string, buf, str->size + 1); // BAD [NOT DETECTED]
153+
154+
strncpy(str->string, buf, size); // BAD [NOT DETECTED]
155+
strncpy(str->string, buf, size - 1); // GOOD
156+
strncpy(str->string, buf, size + 1); // BAD [NOT DETECTED]
157+
158+
if(anotherSize < str->size) {
159+
strncpy(str->string, buf, anotherSize); // GOOD
160+
}
161+
162+
if(anotherSize < size) {
163+
strncpy(str->string, buf, anotherSize); // GOOD
164+
}
165+
166+
if(anotherSize <= str->size) {
167+
strncpy(str->string, buf, anotherSize); // GOOD
168+
}
169+
170+
if(anotherSize <= str->size - 1) {
171+
strncpy(str->string, buf, anotherSize); // GOOD
172+
}
173+
174+
if(anotherSize <= size) {
175+
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
176+
}
177+
178+
if(anotherSize <= size - 1) {
179+
strncpy(str->string, buf, anotherSize); // GOOD
180+
}
181+
182+
if(anotherSize < str->size + 1) {
183+
strncpy(str->string, buf, anotherSize); // GOOD
184+
}
185+
186+
if(anotherSize < size + 1) {
187+
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
188+
}
189+
190+
if(anotherSize < size - 1) {
191+
strncpy(str->string, buf, anotherSize); // GOOD
192+
}
193+
194+
if(anotherSize <= str->size + 1) {
195+
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
196+
}
197+
198+
if(anotherSize <= size + 1) {
199+
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
200+
}
201+
202+
if(anotherSize <= str->size + 2) {
203+
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
204+
}
205+
206+
if(anotherSize <= size + 2) {
207+
strncpy(str->string, buf, anotherSize); // BAD [NOT DETECTED]
208+
}
209+
}
210+

0 commit comments

Comments
 (0)