Skip to content

Commit 754d7f0

Browse files
geoffw0geoffw0
committed
C++: More test cases for TaintedAllocationSize.
1 parent b2f1008 commit 754d7f0

2 files changed

Lines changed: 127 additions & 0 deletions

File tree

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,32 @@ edges
5959
| test.cpp:227:24:227:37 | (const char *)... | test.cpp:237:10:237:19 | (size_t)... |
6060
| test.cpp:235:11:235:20 | (size_t)... | test.cpp:214:23:214:23 | s |
6161
| test.cpp:237:10:237:19 | (size_t)... | test.cpp:220:21:220:21 | s |
62+
| test.cpp:241:2:241:32 | Chi | test.cpp:271:17:271:20 | get_size output argument |
63+
| test.cpp:241:2:241:32 | Chi | test.cpp:279:17:279:20 | get_size output argument |
64+
| test.cpp:241:2:241:32 | Chi | test.cpp:287:18:287:21 | get_size output argument |
65+
| test.cpp:241:2:241:32 | Chi | test.cpp:295:18:295:21 | get_size output argument |
66+
| test.cpp:241:18:241:23 | call to getenv | test.cpp:241:2:241:32 | Chi |
67+
| test.cpp:241:18:241:31 | (const char *)... | test.cpp:241:2:241:32 | Chi |
68+
| test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
69+
| test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... |
70+
| test.cpp:249:20:249:25 | call to getenv | test.cpp:257:11:257:29 | ... * ... |
71+
| test.cpp:249:20:249:25 | call to getenv | test.cpp:257:11:257:29 | ... * ... |
72+
| test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
73+
| test.cpp:249:20:249:33 | (const char *)... | test.cpp:253:11:253:29 | ... * ... |
74+
| test.cpp:249:20:249:33 | (const char *)... | test.cpp:257:11:257:29 | ... * ... |
75+
| test.cpp:249:20:249:33 | (const char *)... | test.cpp:257:11:257:29 | ... * ... |
76+
| test.cpp:261:19:261:24 | call to getenv | test.cpp:266:10:266:27 | ... * ... |
77+
| test.cpp:261:19:261:24 | call to getenv | test.cpp:266:10:266:27 | ... * ... |
78+
| test.cpp:261:19:261:32 | (const char *)... | test.cpp:266:10:266:27 | ... * ... |
79+
| test.cpp:261:19:261:32 | (const char *)... | test.cpp:266:10:266:27 | ... * ... |
80+
| test.cpp:271:17:271:20 | get_size output argument | test.cpp:273:11:273:28 | ... * ... |
81+
| test.cpp:271:17:271:20 | get_size output argument | test.cpp:273:11:273:28 | ... * ... |
82+
| test.cpp:279:17:279:20 | get_size output argument | test.cpp:281:11:281:28 | ... * ... |
83+
| test.cpp:279:17:279:20 | get_size output argument | test.cpp:281:11:281:28 | ... * ... |
84+
| test.cpp:287:18:287:21 | get_size output argument | test.cpp:290:10:290:27 | ... * ... |
85+
| test.cpp:287:18:287:21 | get_size output argument | test.cpp:290:10:290:27 | ... * ... |
86+
| test.cpp:295:18:295:21 | get_size output argument | test.cpp:298:10:298:27 | ... * ... |
87+
| test.cpp:295:18:295:21 | get_size output argument | test.cpp:298:10:298:27 | ... * ... |
6288
nodes
6389
| test.cpp:39:21:39:24 | argv | semmle.label | argv |
6490
| test.cpp:39:21:39:24 | argv | semmle.label | argv |
@@ -122,6 +148,38 @@ nodes
122148
| test.cpp:231:9:231:24 | call to get_tainted_size | semmle.label | call to get_tainted_size |
123149
| test.cpp:235:11:235:20 | (size_t)... | semmle.label | (size_t)... |
124150
| test.cpp:237:10:237:19 | (size_t)... | semmle.label | (size_t)... |
151+
| test.cpp:241:2:241:32 | Chi | semmle.label | Chi |
152+
| test.cpp:241:18:241:23 | call to getenv | semmle.label | call to getenv |
153+
| test.cpp:241:18:241:31 | (const char *)... | semmle.label | (const char *)... |
154+
| test.cpp:249:20:249:25 | call to getenv | semmle.label | call to getenv |
155+
| test.cpp:249:20:249:33 | (const char *)... | semmle.label | (const char *)... |
156+
| test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
157+
| test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
158+
| test.cpp:253:11:253:29 | ... * ... | semmle.label | ... * ... |
159+
| test.cpp:257:11:257:29 | ... * ... | semmle.label | ... * ... |
160+
| test.cpp:257:11:257:29 | ... * ... | semmle.label | ... * ... |
161+
| test.cpp:257:11:257:29 | ... * ... | semmle.label | ... * ... |
162+
| test.cpp:261:19:261:24 | call to getenv | semmle.label | call to getenv |
163+
| test.cpp:261:19:261:32 | (const char *)... | semmle.label | (const char *)... |
164+
| test.cpp:266:10:266:27 | ... * ... | semmle.label | ... * ... |
165+
| test.cpp:266:10:266:27 | ... * ... | semmle.label | ... * ... |
166+
| test.cpp:266:10:266:27 | ... * ... | semmle.label | ... * ... |
167+
| test.cpp:271:17:271:20 | get_size output argument | semmle.label | get_size output argument |
168+
| test.cpp:273:11:273:28 | ... * ... | semmle.label | ... * ... |
169+
| test.cpp:273:11:273:28 | ... * ... | semmle.label | ... * ... |
170+
| test.cpp:273:11:273:28 | ... * ... | semmle.label | ... * ... |
171+
| test.cpp:279:17:279:20 | get_size output argument | semmle.label | get_size output argument |
172+
| test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
173+
| test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
174+
| test.cpp:281:11:281:28 | ... * ... | semmle.label | ... * ... |
175+
| test.cpp:287:18:287:21 | get_size output argument | semmle.label | get_size output argument |
176+
| test.cpp:290:10:290:27 | ... * ... | semmle.label | ... * ... |
177+
| test.cpp:290:10:290:27 | ... * ... | semmle.label | ... * ... |
178+
| test.cpp:290:10:290:27 | ... * ... | semmle.label | ... * ... |
179+
| test.cpp:295:18:295:21 | get_size output argument | semmle.label | get_size output argument |
180+
| test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
181+
| test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
182+
| test.cpp:298:10:298:27 | ... * ... | semmle.label | ... * ... |
125183
#select
126184
| test.cpp:42:31:42:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:42:38:42:44 | tainted | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
127185
| test.cpp:43:31:43:36 | call to malloc | test.cpp:39:21:39:24 | argv | test.cpp:43:38:43:63 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
@@ -136,3 +194,10 @@ nodes
136194
| test.cpp:221:14:221:19 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:221:21:221:21 | s | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
137195
| test.cpp:229:2:229:7 | call to malloc | test.cpp:227:24:227:29 | call to getenv | test.cpp:229:9:229:18 | local_size | This allocation size is derived from $@ and might overflow | test.cpp:227:24:227:29 | call to getenv | user input (getenv) |
138196
| test.cpp:231:2:231:7 | call to malloc | test.cpp:201:14:201:19 | call to getenv | test.cpp:231:9:231:24 | call to get_tainted_size | This allocation size is derived from $@ and might overflow | test.cpp:201:14:201:19 | call to getenv | user input (getenv) |
197+
| test.cpp:253:4:253:9 | call to malloc | test.cpp:249:20:249:25 | call to getenv | test.cpp:253:11:253:29 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:249:20:249:25 | call to getenv | user input (getenv) |
198+
| test.cpp:257:4:257:9 | call to malloc | test.cpp:249:20:249:25 | call to getenv | test.cpp:257:11:257:29 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:249:20:249:25 | call to getenv | user input (getenv) |
199+
| test.cpp:266:3:266:8 | call to malloc | test.cpp:261:19:261:24 | call to getenv | test.cpp:266:10:266:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:261:19:261:24 | call to getenv | user input (getenv) |
200+
| test.cpp:273:4:273:9 | call to malloc | test.cpp:241:18:241:23 | call to getenv | test.cpp:273:11:273:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:241:18:241:23 | call to getenv | user input (getenv) |
201+
| test.cpp:281:4:281:9 | call to malloc | test.cpp:241:18:241:23 | call to getenv | test.cpp:281:11:281:28 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:241:18:241:23 | call to getenv | user input (getenv) |
202+
| test.cpp:290:3:290:8 | call to malloc | test.cpp:241:18:241:23 | call to getenv | test.cpp:290:10:290:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:241:18:241:23 | call to getenv | user input (getenv) |
203+
| test.cpp:298:3:298:8 | call to malloc | test.cpp:241:18:241:23 | call to getenv | test.cpp:298:10:298:27 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:241:18:241:23 | call to getenv | user input (getenv) |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,3 +236,65 @@ void more_cases() {
236236
my_func(100); // GOOD
237237
my_func(local_size); // GOOD
238238
}
239+
240+
bool get_size(int &out_size) {
241+
out_size = atoi(getenv("USER"));
242+
243+
return true;
244+
}
245+
246+
void equality_cases() {
247+
{
248+
int size1 = atoi(getenv("USER"));
249+
int size2 = atoi(getenv("USER"));
250+
251+
if (size1 == 100)
252+
{
253+
malloc(size2 * sizeof(int)); // BAD
254+
}
255+
if (size2 == 100)
256+
{
257+
malloc(size2 * sizeof(int)); // GOOD [FALSE POSITIVE]
258+
}
259+
}
260+
{
261+
int size = atoi(getenv("USER"));
262+
263+
if (size != 100)
264+
return;
265+
266+
malloc(size * sizeof(int)); // GOOD [FALSE POSITIVE]
267+
}
268+
{
269+
int size;
270+
271+
if ((get_size(size)) && (size == 100))
272+
{
273+
malloc(size * sizeof(int)); // GOOD [FALSE POSITIVE]
274+
}
275+
}
276+
{
277+
int size;
278+
279+
if ((get_size(size)) && (size != 100))
280+
{
281+
malloc(size * sizeof(int)); // BAD
282+
}
283+
}
284+
{
285+
int size;
286+
287+
if ((!get_size(size)) || (size != 100))
288+
return;
289+
290+
malloc(size * sizeof(int)); // GOOD [FALSE POSITIVE]
291+
}
292+
{
293+
int size;
294+
295+
if ((!get_size(size)) || (size == 100))
296+
return;
297+
298+
malloc(size * sizeof(int)); // BAD
299+
}
300+
}

0 commit comments

Comments
 (0)