Skip to content

Commit febbbc4

Browse files
geoffw0geoffw0
committed
C++: Additional test cases.
1 parent 433794e commit febbbc4

File tree

2 files changed

+150
-1
lines changed

2 files changed

+150
-1
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,62 @@ edges
6969
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:14 | size |
7070
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:28 | ... * ... |
7171
| test.cpp:138:19:138:32 | (const char *)... | test.cpp:142:11:142:28 | ... * ... |
72+
| test.cpp:201:9:201:12 | call to atoi | test.cpp:201:9:201:12 | call to atoi |
73+
| test.cpp:201:9:201:12 | call to atoi | test.cpp:201:9:201:28 | (unsigned long)... |
74+
| test.cpp:201:9:201:12 | call to atoi | test.cpp:201:9:201:42 | Store |
75+
| test.cpp:201:9:201:42 | Store | test.cpp:231:9:231:24 | call to get_tainted_size |
76+
| test.cpp:201:9:201:42 | Store | test.cpp:231:9:231:24 | call to get_tainted_size |
77+
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:12 | call to atoi |
78+
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:12 | call to atoi |
79+
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:12 | call to atoi |
80+
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:28 | (unsigned long)... |
81+
| test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:42 | Store |
82+
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:12 | call to atoi |
83+
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:12 | call to atoi |
84+
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:12 | call to atoi |
85+
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:28 | (unsigned long)... |
86+
| test.cpp:201:14:201:27 | (const char *)... | test.cpp:201:9:201:42 | Store |
87+
| test.cpp:206:13:206:16 | call to atoi | test.cpp:206:13:206:16 | call to atoi |
88+
| test.cpp:206:13:206:16 | call to atoi | test.cpp:206:13:206:32 | (unsigned long)... |
89+
| test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:16 | call to atoi |
90+
| test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:16 | call to atoi |
91+
| test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:16 | call to atoi |
92+
| test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:32 | (unsigned long)... |
93+
| test.cpp:206:18:206:31 | (const char *)... | test.cpp:206:13:206:16 | call to atoi |
94+
| test.cpp:206:18:206:31 | (const char *)... | test.cpp:206:13:206:16 | call to atoi |
95+
| test.cpp:206:18:206:31 | (const char *)... | test.cpp:206:13:206:16 | call to atoi |
96+
| test.cpp:206:18:206:31 | (const char *)... | test.cpp:206:13:206:32 | (unsigned long)... |
97+
| test.cpp:214:23:214:23 | s | test.cpp:215:21:215:21 | s |
98+
| test.cpp:214:23:214:23 | s | test.cpp:215:21:215:21 | s |
99+
| test.cpp:220:21:220:21 | s | test.cpp:221:21:221:21 | s |
100+
| test.cpp:220:21:220:21 | s | test.cpp:221:21:221:21 | s |
101+
| test.cpp:227:19:227:22 | call to atoi | test.cpp:227:19:227:22 | call to atoi |
102+
| test.cpp:227:19:227:22 | call to atoi | test.cpp:227:19:227:38 | (unsigned long)... |
103+
| test.cpp:227:19:227:22 | call to atoi | test.cpp:229:9:229:18 | (size_t)... |
104+
| test.cpp:227:19:227:22 | call to atoi | test.cpp:229:9:229:18 | local_size |
105+
| test.cpp:227:19:227:22 | call to atoi | test.cpp:229:9:229:18 | local_size |
106+
| test.cpp:227:19:227:22 | call to atoi | test.cpp:235:11:235:20 | (size_t)... |
107+
| test.cpp:227:19:227:22 | call to atoi | test.cpp:237:10:237:19 | (size_t)... |
108+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:22 | call to atoi |
109+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:22 | call to atoi |
110+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:22 | call to atoi |
111+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:38 | (unsigned long)... |
112+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | (size_t)... |
113+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
114+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size |
115+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:235:11:235:20 | (size_t)... |
116+
| test.cpp:227:24:227:29 | call to getenv | test.cpp:237:10:237:19 | (size_t)... |
117+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:227:19:227:22 | call to atoi |
118+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:227:19:227:22 | call to atoi |
119+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:227:19:227:22 | call to atoi |
120+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:227:19:227:38 | (unsigned long)... |
121+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | (size_t)... |
122+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
123+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:229:9:229:18 | local_size |
124+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:235:11:235:20 | (size_t)... |
125+
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:237:10:237:19 | (size_t)... |
126+
| test.cpp:235:11:235:20 | (size_t)... | test.cpp:214:23:214:23 | s |
127+
| test.cpp:237:10:237:19 | (size_t)... | test.cpp:220:21:220:21 | s |
72128
nodes
73129
| test.cpp:39:21:39:24 | argv | semmle.label | argv |
74130
| test.cpp:39:21:39:24 | argv | semmle.label | argv |
@@ -134,6 +190,46 @@ nodes
134190
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
135191
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
136192
| test.cpp:142:11:142:28 | ... * ... | semmle.label | ... * ... |
193+
| test.cpp:201:9:201:12 | call to atoi | semmle.label | call to atoi |
194+
| test.cpp:201:9:201:12 | call to atoi | semmle.label | call to atoi |
195+
| test.cpp:201:9:201:12 | call to atoi | semmle.label | call to atoi |
196+
| test.cpp:201:9:201:28 | (unsigned long)... | semmle.label | (unsigned long)... |
197+
| test.cpp:201:9:201:28 | (unsigned long)... | semmle.label | (unsigned long)... |
198+
| test.cpp:201:9:201:42 | Store | semmle.label | Store |
199+
| test.cpp:201:14:201:19 | call to getenv | semmle.label | call to getenv |
200+
| test.cpp:201:14:201:27 | (const char *)... | semmle.label | (const char *)... |
201+
| test.cpp:206:13:206:16 | call to atoi | semmle.label | call to atoi |
202+
| test.cpp:206:13:206:16 | call to atoi | semmle.label | call to atoi |
203+
| test.cpp:206:13:206:16 | call to atoi | semmle.label | call to atoi |
204+
| test.cpp:206:13:206:32 | (unsigned long)... | semmle.label | (unsigned long)... |
205+
| test.cpp:206:13:206:32 | (unsigned long)... | semmle.label | (unsigned long)... |
206+
| test.cpp:206:18:206:23 | call to getenv | semmle.label | call to getenv |
207+
| test.cpp:206:18:206:31 | (const char *)... | semmle.label | (const char *)... |
208+
| test.cpp:214:23:214:23 | s | semmle.label | s |
209+
| test.cpp:215:21:215:21 | s | semmle.label | s |
210+
| test.cpp:215:21:215:21 | s | semmle.label | s |
211+
| test.cpp:215:21:215:21 | s | semmle.label | s |
212+
| test.cpp:220:21:220:21 | s | semmle.label | s |
213+
| test.cpp:221:21:221:21 | s | semmle.label | s |
214+
| test.cpp:221:21:221:21 | s | semmle.label | s |
215+
| test.cpp:221:21:221:21 | s | semmle.label | s |
216+
| test.cpp:227:19:227:22 | call to atoi | semmle.label | call to atoi |
217+
| test.cpp:227:19:227:22 | call to atoi | semmle.label | call to atoi |
218+
| test.cpp:227:19:227:22 | call to atoi | semmle.label | call to atoi |
219+
| test.cpp:227:19:227:38 | (unsigned long)... | semmle.label | (unsigned long)... |
220+
| test.cpp:227:19:227:38 | (unsigned long)... | semmle.label | (unsigned long)... |
221+
| test.cpp:227:24:227:29 | call to getenv | semmle.label | call to getenv |
222+
| test.cpp:227:24:227:37 | (const char *)... | semmle.label | (const char *)... |
223+
| test.cpp:229:9:229:18 | (size_t)... | semmle.label | (size_t)... |
224+
| test.cpp:229:9:229:18 | (size_t)... | semmle.label | (size_t)... |
225+
| test.cpp:229:9:229:18 | local_size | semmle.label | local_size |
226+
| test.cpp:229:9:229:18 | local_size | semmle.label | local_size |
227+
| test.cpp:229:9:229:18 | local_size | semmle.label | local_size |
228+
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
229+
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
230+
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
231+
| test.cpp:235:11:235:20 | (size_t)... | semmle.label | (size_t)... |
232+
| test.cpp:237:10:237:19 | (size_t)... | semmle.label | (size_t)... |
137233
#select
138234
| test.cpp:42:31:42:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
139235
| test.cpp:43:31:43:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
@@ -149,3 +245,10 @@ nodes
149245
| test.cpp:134:10:134:27 | ... * ... | test.cpp:132:19:132:24 | call to getenv | test.cpp:134:10:134:13 | size | This allocation size is derived from $@ and might overflow | test.cpp:132:19:132:24 | call to getenv | user input (getenv) |
150246
| test.cpp:142:4:142:9 | call to malloc | test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:138:19:138:24 | call to getenv | user input (getenv) |
151247
| test.cpp:142:11:142:28 | ... * ... | test.cpp:138:19:138:24 | call to getenv | test.cpp:142:11:142:14 | size | This allocation size is derived from $@ and might overflow | test.cpp:138:19:138:24 | call to getenv | user input (getenv) |
248+
| test.cpp:201:9:201:42 | ... * ... | test.cpp:201:14:201:19 | call to getenv | test.cpp:201:9:201:12 | call to atoi | This allocation size is derived from $@ and might overflow | test.cpp:201:14:201:19 | call to getenv | user input (getenv) |
249+
| test.cpp:206:13:206:46 | ... * ... | test.cpp:206:18:206:23 | call to getenv | test.cpp:206:13:206:16 | call to atoi | This allocation size is derived from $@ and might overflow | test.cpp:206:18:206:23 | call to getenv | user input (getenv) |
250+
| test.cpp:215:14:215:19 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:215:21:215:21 | s | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
251+
| test.cpp:221:14:221:19 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:221:21:221:21 | s | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
252+
| test.cpp:227:19:227:52 | ... * ... | test.cpp:227:24:227:29 | call to getenv | test.cpp:227:19:227:22 | call to atoi | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
253+
| test.cpp:229:2:229:7 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
254+
| test.cpp:231:2:231:7 | call to malloc | test.cpp:201:14:201:19 | call to getenv | test.cpp:231:9:231:24 | call to get_tainted_size | This allocation size is derived from $@ and might overflow | test.cpp:201:14:201:19 | call to getenv | user input (getenv) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ typedef struct {} FILE;
55

66
void *malloc(size_t size);
77
void *realloc(void *ptr, size_t size);
8+
void free(void *ptr);
89
int atoi(const char *nptr);
9-
1010
struct MyStruct
1111
{
1212
char data[256];
@@ -190,3 +190,49 @@ void more_bounded_tests() {
190190
}
191191
}
192192
}
193+
194+
size_t get_untainted_size()
195+
{
196+
return 10 * sizeof(int);
197+
}
198+
199+
size_t get_tainted_size()
200+
{
201+
return atoi(getenv("USER")) * sizeof(int);
202+
}
203+
204+
size_t get_bounded_size()
205+
{
206+
size_t s = atoi(getenv("USER")) * sizeof(int);
207+
208+
if (s < 0) { s = 0; }
209+
if (s > 100) { s = 100; }
210+
211+
return s;
212+
}
213+
214+
void *my_alloc(size_t s) {
215+
void *ptr = malloc(s); // [UNHELPFUL RESULT]
216+
217+
return ptr;
218+
}
219+
220+
void my_func(size_t s) {
221+
void *ptr = malloc(s); // BAD
222+
223+
free(ptr);
224+
}
225+
226+
void more_cases() {
227+
int local_size = atoi(getenv("USER")) * sizeof(int);
228+
229+
malloc(local_size); // BAD
230+
malloc(get_untainted_size()); // GOOD
231+
malloc(get_tainted_size()); // BAD
232+
malloc(get_bounded_size()); // GOOD
233+
234+
my_alloc(100); // GOOD
235+
my_alloc(local_size); // BAD [NOT DETECTED IN CORRECT LOCATION]
236+
my_func(100); // GOOD
237+
my_func(local_size); // GOOD
238+
}

0 commit comments

Comments
 (0)