Skip to content

Commit 6eba338

Browse files
jbjjbj
authored
Merge pull request github#3241 from geoffw0/alloc-size2
C++ Improvements to TaintedAllocationSize.ql
2 parents bc25050 + 2aa64db commit 6eba338

File tree

4 files changed

+108
-74
lines changed

4 files changed

+108
-74
lines changed

‎change-notes/1.24/analysis-cpp.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ The following changes in version 1.24 affect C/C++ analysis in all applications.
2525
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | | This query is no longer run on LGTM. |
2626
| No space for zero terminator (`cpp/no-space-for-terminator`) | Fewer false positive results | This query has been modified to be more conservative when identifying which pointers point to null-terminated strings. This approach produces fewer, more accurate results. |
2727
| Overflow in uncontrolled allocation size (`cpp/uncontrolled-allocation-size`) | Fewer false positive results | Cases where the tainted allocation size is range checked are now more reliably excluded. |
28+
| Overflow in uncontrolled allocation size (`cpp/uncontrolled-allocation-size`) | Fewer false positive results | The query now produces fewer, more accurate results. |
2829
| Overloaded assignment does not return 'this' (`cpp/assignment-does-not-return-this`) | Fewer false positive results | This query no longer reports incorrect results in template classes. |
2930
| Unsafe array for days of the year (`cpp/leap-year/unsafe-array-for-days-of-the-year`) | | This query is no longer run on LGTM. |
3031
| Unsigned comparison to zero (`cpp/unsigned-comparison-zero`) | More correct results | This query now also looks for comparisons of the form `0 <= x`. |

‎cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,31 +15,31 @@ import cpp
1515
import semmle.code.cpp.security.TaintTracking
1616
import TaintedWithPath
1717

18-
predicate taintedChild(Expr e, Expr tainted) {
19-
(
20-
isAllocationExpr(e)
21-
or
22-
any(MulExpr me | me.getAChild() instanceof SizeofOperator) = e
23-
) and
24-
tainted = e.getAChild() and
18+
/**
19+
* Holds if `alloc` is an allocation, and `tainted` is a child of it that is a
20+
* taint sink.
21+
*/
22+
predicate allocSink(Expr alloc, Expr tainted) {
23+
isAllocationExpr(alloc) and
24+
tainted = alloc.getAChild() and
2525
tainted.getUnspecifiedType() instanceof IntegralType
2626
}
2727

2828
class TaintedAllocationSizeConfiguration extends TaintTrackingConfiguration {
29-
override predicate isSink(Element tainted) { taintedChild(_, tainted) }
29+
override predicate isSink(Element tainted) { allocSink(_, tainted) }
3030
}
3131

3232
predicate taintedAllocSize(
33-
Expr e, Expr source, PathNode sourceNode, PathNode sinkNode, string taintCause
33+
Expr source, Expr alloc, PathNode sourceNode, PathNode sinkNode, string taintCause
3434
) {
3535
isUserInput(source, taintCause) and
3636
exists(Expr tainted |
37-
taintedChild(e, tainted) and
37+
allocSink(alloc, tainted) and
3838
taintedWithPath(source, tainted, sourceNode, sinkNode)
3939
)
4040
}
4141

42-
from Expr e, Expr source, PathNode sourceNode, PathNode sinkNode, string taintCause
43-
where taintedAllocSize(e, source, sourceNode, sinkNode, taintCause)
44-
select e, sourceNode, sinkNode, "This allocation size is derived from $@ and might overflow",
42+
from Expr source, Expr alloc, PathNode sourceNode, PathNode sinkNode, string taintCause
43+
where taintedAllocSize(source, alloc, sourceNode, sinkNode, taintCause)
44+
select alloc, sourceNode, sinkNode, "This allocation size is derived from $@ and might overflow",
4545
source, "user input (" + taintCause + ")"

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

Lines changed: 47 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,6 @@ edges
55
| test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
66
| test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
77
| test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
8-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | (unsigned long)... |
9-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | (unsigned long)... |
10-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted |
11-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted |
12-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted |
13-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted |
148
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
159
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
1610
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
@@ -33,42 +27,38 @@ edges
3327
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
3428
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
3529
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
36-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | (unsigned long)... |
37-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | (unsigned long)... |
38-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted |
39-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted |
40-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted |
41-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted |
42-
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:27 | (unsigned long)... |
43-
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:27 | size |
44-
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:27 | size |
4530
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
4631
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
47-
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:27 | (unsigned long)... |
48-
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:27 | size |
49-
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:27 | size |
5032
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:41 | ... * ... |
5133
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:41 | ... * ... |
52-
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | (unsigned long)... |
53-
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | size |
54-
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | size |
5534
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:27 | ... * ... |
5635
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:27 | ... * ... |
57-
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:13 | (unsigned long)... |
58-
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:13 | size |
59-
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:13 | size |
6036
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:27 | ... * ... |
6137
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:27 | ... * ... |
62-
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | (unsigned long)... |
63-
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | size |
64-
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | size |
6538
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... |
6639
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... |
67-
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:14 | (unsigned long)... |
68-
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:14 | size |
69-
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:14 | size |
7040
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:28 | ... * ... |
7141
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:28 | ... * ... |
42+
| test.cpp:201:9:201:42 | Store | test.cpp:231:9:231:24 | call to get_tainted_size |
43+
| test.cpp:201:9:201:42 | Store | test.cpp:231:9:231:24 | call to get_tainted_size |
44+
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:42 | Store |
45+
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:42 | Store |
46+
| test.cpp:214:23:214:23 | s | test.cpp:215:21:215:21 | s |
47+
| test.cpp:214:23:214:23 | s | test.cpp:215:21:215:21 | s |
48+
| test.cpp:220:21:220:21 | s | test.cpp:221:21:221:21 | s |
49+
| test.cpp:220:21:220:21 | s | test.cpp:221:21:221:21 | s |
50+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | (size_t)... |
51+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
52+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
53+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:235:11:235:20 | (size_t)... |
54+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:237:10:237:19 | (size_t)... |
55+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | (size_t)... |
56+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
57+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
58+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:235:11:235:20 | (size_t)... |
59+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:237:10:237:19 | (size_t)... |
60+
| test.cpp:235:11:235:20 | (size_t)... | test.cpp:214:23:214:23 | s |
61+
| test.cpp:237:10:237:19 | (size_t)... | test.cpp:220:21:220:21 | s |
7262
nodes
7363
| test.cpp:39:21:39:24 | argv | semmle.label | argv |
7464
| test.cpp:39:21:39:24 | argv | semmle.label | argv |
@@ -77,11 +67,6 @@ nodes
7767
| test.cpp:42:38:42:44 | tainted | semmle.label | tainted |
7868
| test.cpp:42:38:42:44 | tainted | semmle.label | tainted |
7969
| test.cpp:42:38:42:44 | tainted | semmle.label | tainted |
80-
| test.cpp:43:38:43:44 | (unsigned long)... | semmle.label | (unsigned long)... |
81-
| test.cpp:43:38:43:44 | (unsigned long)... | semmle.label | (unsigned long)... |
82-
| test.cpp:43:38:43:44 | tainted | semmle.label | tainted |
83-
| test.cpp:43:38:43:44 | tainted | semmle.label | tainted |
84-
| test.cpp:43:38:43:44 | tainted | semmle.label | tainted |
8570
| test.cpp:43:38:43:63 | ... * ... | semmle.label | ... * ... |
8671
| test.cpp:43:38:43:63 | ... * ... | semmle.label | ... * ... |
8772
| test.cpp:43:38:43:63 | ... * ... | semmle.label | ... * ... |
@@ -99,53 +84,55 @@ nodes
9984
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
10085
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
10186
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
102-
| test.cpp:52:54:52:60 | (unsigned long)... | semmle.label | (unsigned long)... |
103-
| test.cpp:52:54:52:60 | (unsigned long)... | semmle.label | (unsigned long)... |
104-
| test.cpp:52:54:52:60 | tainted | semmle.label | tainted |
105-
| test.cpp:52:54:52:60 | tainted | semmle.label | tainted |
106-
| test.cpp:52:54:52:60 | tainted | semmle.label | tainted |
10787
| test.cpp:123:18:123:23 | call to getenv | semmle.label | call to getenv |
10888
| test.cpp:123:18:123:31 | (const char *)... | semmle.label | (const char *)... |
109-
| test.cpp:127:24:127:27 | (unsigned long)... | semmle.label | (unsigned long)... |
110-
| test.cpp:127:24:127:27 | (unsigned long)... | semmle.label | (unsigned long)... |
111-
| test.cpp:127:24:127:27 | size | semmle.label | size |
112-
| test.cpp:127:24:127:27 | size | semmle.label | size |
113-
| test.cpp:127:24:127:27 | size | semmle.label | size |
11489
| test.cpp:127:24:127:41 | ... * ... | semmle.label | ... * ... |
11590
| test.cpp:127:24:127:41 | ... * ... | semmle.label | ... * ... |
11691
| test.cpp:127:24:127:41 | ... * ... | semmle.label | ... * ... |
11792
| test.cpp:132:19:132:24 | call to getenv | semmle.label | call to getenv |
11893
| test.cpp:132:19:132:32 | (const char *)... | semmle.label | (const char *)... |
119-
| test.cpp:134:10:134:13 | (unsigned long)... | semmle.label | (unsigned long)... |
120-
| test.cpp:134:10:134:13 | (unsigned long)... | semmle.label | (unsigned long)... |
121-
| test.cpp:134:10:134:13 | size | semmle.label | size |
122-
| test.cpp:134:10:134:13 | size | semmle.label | size |
123-
| test.cpp:134:10:134:13 | size | semmle.label | size |
12494
| test.cpp:134:10:134:27 | ... * ... | semmle.label | ... * ... |
12595
| test.cpp:134:10:134:27 | ... * ... | semmle.label | ... * ... |
12696
| test.cpp:134:10:134:27 | ... * ... | semmle.label | ... * ... |
12797
| test.cpp:138:19:138:24 | call to getenv | semmle.label | call to getenv |
12898
| test.cpp:138:19:138:32 | (const char *)... | semmle.label | (const char *)... |
129-
| test.cpp:142:11:142:14 | (unsigned long)... | semmle.label | (unsigned long)... |
130-
| test.cpp:142:11:142:14 | (unsigned long)... | semmle.label | (unsigned long)... |
131-
| test.cpp:142:11:142:14 | size | semmle.label | size |
132-
| test.cpp:142:11:142:14 | size | semmle.label | size |
133-
| test.cpp:142:11:142:14 | size | semmle.label | size |
13499
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
135100
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
136101
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
102+
| test.cpp:201:9:201:42 | Store | semmle.label | Store |
103+
| test.cpp:201:14:201:19 | call to getenv | semmle.label | call to getenv |
104+
| test.cpp:201:14:201:27 | (const char *)... | semmle.label | (const char *)... |
105+
| test.cpp:214:23:214:23 | s | semmle.label | s |
106+
| test.cpp:215:21:215:21 | s | semmle.label | s |
107+
| test.cpp:215:21:215:21 | s | semmle.label | s |
108+
| test.cpp:215:21:215:21 | s | semmle.label | s |
109+
| test.cpp:220:21:220:21 | s | semmle.label | s |
110+
| test.cpp:221:21:221:21 | s | semmle.label | s |
111+
| test.cpp:221:21:221:21 | s | semmle.label | s |
112+
| test.cpp:221:21:221:21 | s | semmle.label | s |
113+
| test.cpp:227:24:227:29 | call to getenv | semmle.label | call to getenv |
114+
| test.cpp:227:24:227:37 | (const char *)... | semmle.label | (const char *)... |
115+
| test.cpp:229:9:229:18 | (size_t)... | semmle.label | (size_t)... |
116+
| test.cpp:229:9:229:18 | (size_t)... | semmle.label | (size_t)... |
117+
| test.cpp:229:9:229:18 | local_size | semmle.label | local_size |
118+
| test.cpp:229:9:229:18 | local_size | semmle.label | local_size |
119+
| test.cpp:229:9:229:18 | local_size | semmle.label | local_size |
120+
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
121+
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
122+
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
123+
| test.cpp:235:11:235:20 | (size_t)... | semmle.label | (size_t)... |
124+
| test.cpp:237:10:237:19 | (size_t)... | semmle.label | (size_t)... |
137125
#select
138126
| test.cpp:42:31:42:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
139127
| test.cpp:43:31:43:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
140-
| test.cpp:43:38:43:63 | ... * ... | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
141128
| test.cpp:45:31:45:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:45:38:45:63 | ... + ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
142129
| test.cpp:48:25:48:30 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
143130
| test.cpp:49:17:49:30 | new[] | test.cpp:39:21:39:24 | argv | test.cpp:49:26:49:29 | size | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
144131
| test.cpp:52:21:52:27 | call to realloc | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
145-
| test.cpp:52:35:52:60 | ... * ... | test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
146132
| test.cpp:127:17:127:22 | call to malloc | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:123:18:123:23 | call to getenv | user input (getenv) |
147-
| test.cpp:127:24:127:41 | ... * ... | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:27 | size | This allocation size is derived from $@ and might overflow | test.cpp:123:18:123:23 | call to getenv | user input (getenv) |
148133
| test.cpp:134:3:134:8 | call to malloc | test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:132:19:132:24 | call to getenv | user input (getenv) |
149-
| test.cpp:134:10:134:27 | ... * ... | test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | size | This allocation size is derived from $@ and might overflow | test.cpp:132:19:132:24 | call to getenv | user input (getenv) |
150134
| test.cpp:142:4:142:9 | call to malloc | test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:138:19:138:24 | call to getenv | user input (getenv) |
151-
| test.cpp:142:11:142:28 | ... * ... | test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | size | This allocation size is derived from $@ and might overflow | test.cpp:138:19:138:24 | call to getenv | user input (getenv) |
135+
| test.cpp:215:14:215:19 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:215:21:215:21 | s | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
136+
| test.cpp:221:14:221:19 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:221:21:221:21 | s | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
137+
| test.cpp:229:2:229:7 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
138+
| test.cpp:231:2:231:7 | call to malloc | test.cpp:201:14:201:19 | call to getenv | test.cpp:231:9:231:24 | call to get_tainted_size | This allocation size is derived from $@ and might overflow | test.cpp:201:14:201:19 | call to getenv | user input (getenv) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ typedef struct {} FILE;
55

66
void *malloc(size_t size);
77
void *realloc(void *ptr, size_t size);
8+
void free(void *ptr);
89
int atoi(const char *nptr);
9-
1010
struct MyStruct
1111
{
1212
char data[256];
@@ -190,3 +190,49 @@ void more_bounded_tests() {
190190
}
191191
}
192192
}
193+
194+
size_t get_untainted_size()
195+
{
196+
return 10 * sizeof(int);
197+
}
198+
199+
size_t get_tainted_size()
200+
{
201+
return atoi(getenv("USER")) * sizeof(int);
202+
}
203+
204+
size_t get_bounded_size()
205+
{
206+
size_t s = atoi(getenv("USER")) * sizeof(int);
207+
208+
if (s < 0) { s = 0; }
209+
if (s > 100) { s = 100; }
210+
211+
return s;
212+
}
213+
214+
void *my_alloc(size_t s) {
215+
void *ptr = malloc(s); // [UNHELPFUL RESULT]
216+
217+
return ptr;
218+
}
219+
220+
void my_func(size_t s) {
221+
void *ptr = malloc(s); // BAD
222+
223+
free(ptr);
224+
}
225+
226+
void more_cases() {
227+
int local_size = atoi(getenv("USER")) * sizeof(int);
228+
229+
malloc(local_size); // BAD
230+
malloc(get_untainted_size()); // GOOD
231+
malloc(get_tainted_size()); // BAD
232+
malloc(get_bounded_size()); // GOOD
233+
234+
my_alloc(100); // GOOD
235+
my_alloc(local_size); // BAD [NOT DETECTED IN CORRECT LOCATION]
236+
my_func(100); // GOOD
237+
my_func(local_size); // GOOD
238+
}

0 commit comments

Comments
 (0)