Skip to content

Commit a7979fd

Browse files
geoffw0geoffw0
committed
C++: Base results purely on allocations now, not multiplications by a sizeof.
1 parent febbbc4 commit a7979fd

File tree

2 files changed

+1
-121
lines changed

2 files changed

+1
-121
lines changed

‎cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,7 @@ import semmle.code.cpp.security.TaintTracking
1616
import TaintedWithPath
1717

1818
predicate taintedChild(Expr e, Expr tainted) {
19-
(
20-
isAllocationExpr(e)
21-
or
22-
any(MulExpr me | me.getAChild() instanceof SizeofOperator) = e
23-
) and
19+
isAllocationExpr(e) and
2420
tainted = e.getAChild() and
2521
tainted.getUnspecifiedType() instanceof IntegralType
2622
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

Lines changed: 0 additions & 116 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,6 @@ edges
55
| test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
66
| test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
77
| test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted |
8-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | (unsigned long)... |
9-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | (unsigned long)... |
10-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted |
11-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted |
12-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted |
13-
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted |
148
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
159
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
1610
| test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... |
@@ -33,91 +27,31 @@ edges
3327
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
3428
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
3529
| test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... |
36-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | (unsigned long)... |
37-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | (unsigned long)... |
38-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted |
39-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted |
40-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted |
41-
| test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted |
42-
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:27 | (unsigned long)... |
43-
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:27 | size |
44-
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:27 | size |
4530
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
4631
| test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... |
47-
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:27 | (unsigned long)... |
48-
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:27 | size |
49-
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:27 | size |
5032
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:41 | ... * ... |
5133
| test.cpp:123:18:123:31 | (const char *)... | test.cpp:127:24:127:41 | ... * ... |
52-
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | (unsigned long)... |
53-
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | size |
54-
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | size |
5534
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:27 | ... * ... |
5635
| test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:27 | ... * ... |
57-
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:13 | (unsigned long)... |
58-
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:13 | size |
59-
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:13 | size |
6036
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:27 | ... * ... |
6137
| test.cpp:132:19:132:32 | (const char *)... | test.cpp:134:10:134:27 | ... * ... |
62-
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | (unsigned long)... |
63-
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | size |
64-
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | size |
6538
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... |
6639
| test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... |
67-
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:14 | (unsigned long)... |
68-
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:14 | size |
69-
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:14 | size |
7040
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:28 | ... * ... |
7141
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:28 | ... * ... |
72-
| test.cpp:201:9:201:12 | call to atoi | test.cpp:201:9:201:12 | call to atoi |
73-
| test.cpp:201:9:201:12 | call to atoi | test.cpp:201:9:201:28 | (unsigned long)... |
74-
| test.cpp:201:9:201:12 | call to atoi | test.cpp:201:9:201:42 | Store |
7542
| test.cpp:201:9:201:42 | Store | test.cpp:231:9:231:24 | call to get_tainted_size |
7643
| test.cpp:201:9:201:42 | Store | test.cpp:231:9:231:24 | call to get_tainted_size |
77-
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:12 | call to atoi |
78-
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:12 | call to atoi |
79-
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:12 | call to atoi |
80-
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:28 | (unsigned long)... |
8144
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:42 | Store |
82-
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:12 | call to atoi |
83-
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:12 | call to atoi |
84-
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:12 | call to atoi |
85-
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:28 | (unsigned long)... |
8645
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:42 | Store |
87-
| test.cpp:206:13:206:16 | call to atoi | test.cpp:206:13:206:16 | call to atoi |
88-
| test.cpp:206:13:206:16 | call to atoi | test.cpp:206:13:206:32 | (unsigned long)... |
89-
| test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:16 | call to atoi |
90-
| test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:16 | call to atoi |
91-
| test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:16 | call to atoi |
92-
| test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:32 | (unsigned long)... |
93-
| test.cpp:206:18:206:31 | (const char *)... | test.cpp:206:13:206:16 | call to atoi |
94-
| test.cpp:206:18:206:31 | (const char *)... | test.cpp:206:13:206:16 | call to atoi |
95-
| test.cpp:206:18:206:31 | (const char *)... | test.cpp:206:13:206:16 | call to atoi |
96-
| test.cpp:206:18:206:31 | (const char *)... | test.cpp:206:13:206:32 | (unsigned long)... |
9746
| test.cpp:214:23:214:23 | s | test.cpp:215:21:215:21 | s |
9847
| test.cpp:214:23:214:23 | s | test.cpp:215:21:215:21 | s |
9948
| test.cpp:220:21:220:21 | s | test.cpp:221:21:221:21 | s |
10049
| test.cpp:220:21:220:21 | s | test.cpp:221:21:221:21 | s |
101-
| test.cpp:227:19:227:22 | call to atoi | test.cpp:227:19:227:22 | call to atoi |
102-
| test.cpp:227:19:227:22 | call to atoi | test.cpp:227:19:227:38 | (unsigned long)... |
103-
| test.cpp:227:19:227:22 | call to atoi | test.cpp:229:9:229:18 | (size_t)... |
104-
| test.cpp:227:19:227:22 | call to atoi | test.cpp:229:9:229:18 | local_size |
105-
| test.cpp:227:19:227:22 | call to atoi | test.cpp:229:9:229:18 | local_size |
106-
| test.cpp:227:19:227:22 | call to atoi | test.cpp:235:11:235:20 | (size_t)... |
107-
| test.cpp:227:19:227:22 | call to atoi | test.cpp:237:10:237:19 | (size_t)... |
108-
| test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:22 | call to atoi |
109-
| test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:22 | call to atoi |
110-
| test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:22 | call to atoi |
111-
| test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:38 | (unsigned long)... |
11250
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | (size_t)... |
11351
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
11452
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
11553
| test.cpp:227:24:227:29 | call to getenv | test.cpp:235:11:235:20 | (size_t)... |
11654
| test.cpp:227:24:227:29 | call to getenv | test.cpp:237:10:237:19 | (size_t)... |
117-
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:227:19:227:22 | call to atoi |
118-
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:227:19:227:22 | call to atoi |
119-
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:227:19:227:22 | call to atoi |
120-
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:227:19:227:38 | (unsigned long)... |
12155
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | (size_t)... |
12256
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
12357
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
@@ -133,11 +67,6 @@ nodes
13367
| test.cpp:42:38:42:44 | tainted | semmle.label | tainted |
13468
| test.cpp:42:38:42:44 | tainted | semmle.label | tainted |
13569
| test.cpp:42:38:42:44 | tainted | semmle.label | tainted |
136-
| test.cpp:43:38:43:44 | (unsigned long)... | semmle.label | (unsigned long)... |
137-
| test.cpp:43:38:43:44 | (unsigned long)... | semmle.label | (unsigned long)... |
138-
| test.cpp:43:38:43:44 | tainted | semmle.label | tainted |
139-
| test.cpp:43:38:43:44 | tainted | semmle.label | tainted |
140-
| test.cpp:43:38:43:44 | tainted | semmle.label | tainted |
14170
| test.cpp:43:38:43:63 | ... * ... | semmle.label | ... * ... |
14271
| test.cpp:43:38:43:63 | ... * ... | semmle.label | ... * ... |
14372
| test.cpp:43:38:43:63 | ... * ... | semmle.label | ... * ... |
@@ -155,56 +84,24 @@ nodes
15584
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
15685
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
15786
| test.cpp:52:35:52:60 | ... * ... | semmle.label | ... * ... |
158-
| test.cpp:52:54:52:60 | (unsigned long)... | semmle.label | (unsigned long)... |
159-
| test.cpp:52:54:52:60 | (unsigned long)... | semmle.label | (unsigned long)... |
160-
| test.cpp:52:54:52:60 | tainted | semmle.label | tainted |
161-
| test.cpp:52:54:52:60 | tainted | semmle.label | tainted |
162-
| test.cpp:52:54:52:60 | tainted | semmle.label | tainted |
16387
| test.cpp:123:18:123:23 | call to getenv | semmle.label | call to getenv |
16488
| test.cpp:123:18:123:31 | (const char *)... | semmle.label | (const char *)... |
165-
| test.cpp:127:24:127:27 | (unsigned long)... | semmle.label | (unsigned long)... |
166-
| test.cpp:127:24:127:27 | (unsigned long)... | semmle.label | (unsigned long)... |
167-
| test.cpp:127:24:127:27 | size | semmle.label | size |
168-
| test.cpp:127:24:127:27 | size | semmle.label | size |
169-
| test.cpp:127:24:127:27 | size | semmle.label | size |
17089
| test.cpp:127:24:127:41 | ... * ... | semmle.label | ... * ... |
17190
| test.cpp:127:24:127:41 | ... * ... | semmle.label | ... * ... |
17291
| test.cpp:127:24:127:41 | ... * ... | semmle.label | ... * ... |
17392
| test.cpp:132:19:132:24 | call to getenv | semmle.label | call to getenv |
17493
| test.cpp:132:19:132:32 | (const char *)... | semmle.label | (const char *)... |
175-
| test.cpp:134:10:134:13 | (unsigned long)... | semmle.label | (unsigned long)... |
176-
| test.cpp:134:10:134:13 | (unsigned long)... | semmle.label | (unsigned long)... |
177-
| test.cpp:134:10:134:13 | size | semmle.label | size |
178-
| test.cpp:134:10:134:13 | size | semmle.label | size |
179-
| test.cpp:134:10:134:13 | size | semmle.label | size |
18094
| test.cpp:134:10:134:27 | ... * ... | semmle.label | ... * ... |
18195
| test.cpp:134:10:134:27 | ... * ... | semmle.label | ... * ... |
18296
| test.cpp:134:10:134:27 | ... * ... | semmle.label | ... * ... |
18397
| test.cpp:138:19:138:24 | call to getenv | semmle.label | call to getenv |
18498
| test.cpp:138:19:138:32 | (const char *)... | semmle.label | (const char *)... |
185-
| test.cpp:142:11:142:14 | (unsigned long)... | semmle.label | (unsigned long)... |
186-
| test.cpp:142:11:142:14 | (unsigned long)... | semmle.label | (unsigned long)... |
187-
| test.cpp:142:11:142:14 | size | semmle.label | size |
188-
| test.cpp:142:11:142:14 | size | semmle.label | size |
189-
| test.cpp:142:11:142:14 | size | semmle.label | size |
19099
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
191100
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
192101
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
193-
| test.cpp:201:9:201:12 | call to atoi | semmle.label | call to atoi |
194-
| test.cpp:201:9:201:12 | call to atoi | semmle.label | call to atoi |
195-
| test.cpp:201:9:201:12 | call to atoi | semmle.label | call to atoi |
196-
| test.cpp:201:9:201:28 | (unsigned long)... | semmle.label | (unsigned long)... |
197-
| test.cpp:201:9:201:28 | (unsigned long)... | semmle.label | (unsigned long)... |
198102
| test.cpp:201:9:201:42 | Store | semmle.label | Store |
199103
| test.cpp:201:14:201:19 | call to getenv | semmle.label | call to getenv |
200104
| test.cpp:201:14:201:27 | (const char *)... | semmle.label | (const char *)... |
201-
| test.cpp:206:13:206:16 | call to atoi | semmle.label | call to atoi |
202-
| test.cpp:206:13:206:16 | call to atoi | semmle.label | call to atoi |
203-
| test.cpp:206:13:206:16 | call to atoi | semmle.label | call to atoi |
204-
| test.cpp:206:13:206:32 | (unsigned long)... | semmle.label | (unsigned long)... |
205-
| test.cpp:206:13:206:32 | (unsigned long)... | semmle.label | (unsigned long)... |
206-
| test.cpp:206:18:206:23 | call to getenv | semmle.label | call to getenv |
207-
| test.cpp:206:18:206:31 | (const char *)... | semmle.label | (const char *)... |
208105
| test.cpp:214:23:214:23 | s | semmle.label | s |
209106
| test.cpp:215:21:215:21 | s | semmle.label | s |
210107
| test.cpp:215:21:215:21 | s | semmle.label | s |
@@ -213,11 +110,6 @@ nodes
213110
| test.cpp:221:21:221:21 | s | semmle.label | s |
214111
| test.cpp:221:21:221:21 | s | semmle.label | s |
215112
| test.cpp:221:21:221:21 | s | semmle.label | s |
216-
| test.cpp:227:19:227:22 | call to atoi | semmle.label | call to atoi |
217-
| test.cpp:227:19:227:22 | call to atoi | semmle.label | call to atoi |
218-
| test.cpp:227:19:227:22 | call to atoi | semmle.label | call to atoi |
219-
| test.cpp:227:19:227:38 | (unsigned long)... | semmle.label | (unsigned long)... |
220-
| test.cpp:227:19:227:38 | (unsigned long)... | semmle.label | (unsigned long)... |
221113
| test.cpp:227:24:227:29 | call to getenv | semmle.label | call to getenv |
222114
| test.cpp:227:24:227:37 | (const char *)... | semmle.label | (const char *)... |
223115
| test.cpp:229:9:229:18 | (size_t)... | semmle.label | (size_t)... |
@@ -233,22 +125,14 @@ nodes
233125
#select
234126
| test.cpp:42:31:42:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
235127
| test.cpp:43:31:43:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
236-
| test.cpp:43:38:43:63 | ... * ... | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
237128
| test.cpp:45:31:45:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:45:38:45:63 | ... + ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
238129
| test.cpp:48:25:48:30 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:48:32:48:35 | size | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
239130
| test.cpp:49:17:49:30 | new[] | test.cpp:39:21:39:24 | argv | test.cpp:49:26:49:29 | size | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
240131
| test.cpp:52:21:52:27 | call to realloc | test.cpp:39:21:39:24 | argv | test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
241-
| test.cpp:52:35:52:60 | ... * ... | test.cpp:39:21:39:24 | argv | test.cpp:52:54:52:60 | tainted | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
242132
| test.cpp:127:17:127:22 | call to malloc | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:41 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:123:18:123:23 | call to getenv | user input (getenv) |
243-
| test.cpp:127:24:127:41 | ... * ... | test.cpp:123:18:123:23 | call to getenv | test.cpp:127:24:127:27 | size | This allocation size is derived from $@ and might overflow | test.cpp:123:18:123:23 | call to getenv | user input (getenv) |
244133
| test.cpp:134:3:134:8 | call to malloc | test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:132:19:132:24 | call to getenv | user input (getenv) |
245-
| test.cpp:134:10:134:27 | ... * ... | test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | size | This allocation size is derived from $@ and might overflow | test.cpp:132:19:132:24 | call to getenv | user input (getenv) |
246134
| test.cpp:142:4:142:9 | call to malloc | test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:138:19:138:24 | call to getenv | user input (getenv) |
247-
| test.cpp:142:11:142:28 | ... * ... | test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | size | This allocation size is derived from $@ and might overflow | test.cpp:138:19:138:24 | call to getenv | user input (getenv) |
248-
| test.cpp:201:9:201:42 | ... * ... | test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:12 | call to atoi | This allocation size is derived from $@ and might overflow | test.cpp:201:14:201:19 | call to getenv | user input (getenv) |
249-
| test.cpp:206:13:206:46 | ... * ... | test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:16 | call to atoi | This allocation size is derived from $@ and might overflow | test.cpp:206:18:206:23 | call to getenv | user input (getenv) |
250135
| test.cpp:215:14:215:19 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:215:21:215:21 | s | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
251136
| test.cpp:221:14:221:19 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:221:21:221:21 | s | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
252-
| test.cpp:227:19:227:52 | ... * ... | test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:22 | call to atoi | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
253137
| test.cpp:229:2:229:7 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
254138
| test.cpp:231:2:231:7 | call to malloc | test.cpp:201:14:201:19 | call to getenv | test.cpp:231:9:231:24 | call to get_tainted_size | This allocation size is derived from $@ and might overflow | test.cpp:201:14:201:19 | call to getenv | user input (getenv) |

0 commit comments

Comments
 (0)