Skip to content

Commit 8ac8101

Browse files
rdmarsh2rdmarsh2
committed
C++: convert to path-problem
1 parent 423e0bf commit 8ac8101

File tree

2 files changed

+45
-15
lines changed

2 files changed

+45
-15
lines changed

‎cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
/**
22
* @id cpp/constant-size-array-off-by-one
3-
* @kind problem
3+
* @kind path-problem
44
*/
55

66
import experimental.semmle.code.cpp.semantic.analysis.RangeAnalysis
@@ -10,6 +10,8 @@ import semmle.code.cpp.ir.IR
1010
import experimental.semmle.code.cpp.ir.dataflow.DataFlow
1111
import experimental.semmle.code.cpp.ir.dataflow.DataFlow2
1212

13+
import DataFlow2::PathGraph
14+
1315
pragma[nomagic]
1416
Instruction getABoundIn(SemBound b, IRFunction func) {
1517
result = b.getExpr(0) and
@@ -89,12 +91,12 @@ class PointerArithmeticToDerefConf extends DataFlow2::Configuration {
8991
}
9092

9193
from
92-
Field f, DataFlow::Node source, DataFlow::Node sink, Instruction deref,
94+
Field f, DataFlow2::PathNode source, DataFlow2::PathNode sink, Instruction deref,
9395
PointerArithmeticToDerefConf conf, string operation, int delta
9496
where
95-
conf.hasFlow(source, sink) and
96-
isInvalidPointerDerefSink(sink, deref, operation) and
97-
isConstantSizeOverflowSource(f, source.asInstruction(), delta)
98-
select source,
97+
conf.hasFlowPath(source, sink) and
98+
isInvalidPointerDerefSink(sink.getNode(), deref, operation) and
99+
isConstantSizeOverflowSource(f, source.getNode().asInstruction(), delta)
100+
select source, source, sink,
99101
"This pointer arithmetic may have an off-by-" + (delta + 1) +
100102
" error allowing it to overrun $@ at this $@.", f, f.getName(), deref, operation

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected

Lines changed: 37 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,37 @@
1-
| test.cpp:35:5:35:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:35:5:35:26 | Store: ... = ... | write |
2-
| test.cpp:36:5:36:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:36:5:36:28 | Store: ... = ... | write |
3-
| test.cpp:43:9:43:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:43:9:43:23 | Store: ... = ... | write |
4-
| test.cpp:49:5:49:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:49:5:49:26 | Store: ... = ... | write |
5-
| test.cpp:50:5:50:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:50:5:50:28 | Store: ... = ... | write |
6-
| test.cpp:57:9:57:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:57:9:57:23 | Store: ... = ... | write |
7-
| test.cpp:61:9:61:19 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:61:9:61:23 | Store: ... = ... | write |
8-
| test.cpp:72:5:72:15 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:72:5:72:19 | Store: ... = ... | write |
9-
| test.cpp:77:27:77:44 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
1+
edges
2+
| test.cpp:66:32:66:32 | p | test.cpp:66:32:66:32 | Load |
3+
| test.cpp:66:32:66:32 | p | test.cpp:67:5:67:6 | * ... |
4+
| test.cpp:66:32:66:32 | p | test.cpp:67:6:67:6 | Load |
5+
| test.cpp:77:26:77:44 | & ... | test.cpp:66:32:66:32 | p |
6+
| test.cpp:77:26:77:44 | & ... | test.cpp:66:32:66:32 | p |
7+
| test.cpp:77:27:77:44 | access to array | test.cpp:77:26:77:44 | & ... |
8+
nodes
9+
| test.cpp:35:5:35:22 | access to array | semmle.label | access to array |
10+
| test.cpp:36:5:36:24 | access to array | semmle.label | access to array |
11+
| test.cpp:43:9:43:19 | access to array | semmle.label | access to array |
12+
| test.cpp:49:5:49:22 | access to array | semmle.label | access to array |
13+
| test.cpp:50:5:50:24 | access to array | semmle.label | access to array |
14+
| test.cpp:57:9:57:19 | access to array | semmle.label | access to array |
15+
| test.cpp:61:9:61:19 | access to array | semmle.label | access to array |
16+
| test.cpp:66:32:66:32 | Load | semmle.label | Load |
17+
| test.cpp:66:32:66:32 | p | semmle.label | p |
18+
| test.cpp:66:32:66:32 | p | semmle.label | p |
19+
| test.cpp:67:5:67:6 | * ... | semmle.label | * ... |
20+
| test.cpp:67:6:67:6 | Load | semmle.label | Load |
21+
| test.cpp:72:5:72:15 | access to array | semmle.label | access to array |
22+
| test.cpp:77:26:77:44 | & ... | semmle.label | & ... |
23+
| test.cpp:77:27:77:44 | access to array | semmle.label | access to array |
24+
subpaths
25+
#select
26+
| test.cpp:35:5:35:22 | access to array | test.cpp:35:5:35:22 | access to array | test.cpp:35:5:35:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:35:5:35:26 | Store: ... = ... | write |
27+
| test.cpp:36:5:36:24 | access to array | test.cpp:36:5:36:24 | access to array | test.cpp:36:5:36:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:36:5:36:28 | Store: ... = ... | write |
28+
| test.cpp:43:9:43:19 | access to array | test.cpp:43:9:43:19 | access to array | test.cpp:43:9:43:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:43:9:43:23 | Store: ... = ... | write |
29+
| test.cpp:49:5:49:22 | access to array | test.cpp:49:5:49:22 | access to array | test.cpp:49:5:49:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:49:5:49:26 | Store: ... = ... | write |
30+
| test.cpp:50:5:50:24 | access to array | test.cpp:50:5:50:24 | access to array | test.cpp:50:5:50:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:50:5:50:28 | Store: ... = ... | write |
31+
| test.cpp:57:9:57:19 | access to array | test.cpp:57:9:57:19 | access to array | test.cpp:57:9:57:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:57:9:57:23 | Store: ... = ... | write |
32+
| test.cpp:61:9:61:19 | access to array | test.cpp:61:9:61:19 | access to array | test.cpp:61:9:61:19 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:61:9:61:23 | Store: ... = ... | write |
33+
| test.cpp:72:5:72:15 | access to array | test.cpp:72:5:72:15 | access to array | test.cpp:72:5:72:15 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:72:5:72:19 | Store: ... = ... | write |
34+
| test.cpp:77:27:77:44 | access to array | test.cpp:77:27:77:44 | access to array | test.cpp:66:32:66:32 | Load | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
35+
| test.cpp:77:27:77:44 | access to array | test.cpp:77:27:77:44 | access to array | test.cpp:66:32:66:32 | p | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
36+
| test.cpp:77:27:77:44 | access to array | test.cpp:77:27:77:44 | access to array | test.cpp:67:5:67:6 | * ... | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
37+
| test.cpp:77:27:77:44 | access to array | test.cpp:77:27:77:44 | access to array | test.cpp:67:6:67:6 | Load | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |

0 commit comments

Comments
 (0)