complete the minizip query

Author: am0o0

cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/DecompressionBombsMiniZip.ql

@@ -15,6 +15,43 @@ import cpp
 import semmle.code.cpp.ir.dataflow.TaintTracking
 import semmle.code.cpp.security.FlowSources
 
+/**
+ * The `mz_zip_reader_create` function as a Flow source
+ * create a `mz_zip_reader` instance
+ */
+private class Mz_zip_reader_create extends Function {
+  Mz_zip_reader_create() { this.hasGlobalName("mz_zip_reader_create") }
+}
+
+/**
+ * The `mz_zip_create` function as a Flow source
+ * create a `mz_zip` instance
+ */
+private class Mz_zip_create extends Function {
+  Mz_zip_create() { this.hasGlobalName("mz_zip_create") }
+}
+
+/**
+ * The `mz_zip_entry` function is used in Flow source
+ * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip.md)
+ */
+private class Mz_zip_entry extends Function {
+  Mz_zip_entry() { this.hasGlobalName("mz_zip_entry_read") }
+}
+
+/**
+ * The `mz_zip_reader_entry_*` and `mz_zip_reader_save_all` functions are used in Flow source
+ * [docuemnt](https://github.com/zlib-ng/minizip-ng/blob/master/doc/mz_zip_rw.md)
+ */
+private class Mz_zip_reader_entry extends Function {
+  Mz_zip_reader_entry() {
+    this.hasGlobalName([
+        "mz_zip_reader_entry_save", "mz_zip_reader_entry_read", "mz_zip_reader_entry_save_process",
+        "mz_zip_reader_entry_save_file", "mz_zip_reader_entry_save_buffer", "mz_zip_reader_save_all"
+      ])
+  }
+}
+
 /**
  * A `unzFile` Variable as a Flow source
  */
@@ -29,13 +66,6 @@ private class UnzOpenFunction extends Function {
   UnzOpenFunction() { this.hasGlobalName(["UnzOpen", "unzOpen64", "unzOpen2", "unzOpen2_64"]) }
 }
 
-/**
- * The `mz_stream_open` function is used in Flow source
- */
-private class MzStreamOpenFunction extends Function {
-  MzStreamOpenFunction() { this.hasGlobalName("mz_stream_open") }
-}
-
 /**
  * The `unzReadCurrentFile` function is used in Flow sink
  */
@@ -55,24 +85,31 @@ module MiniZipTaintConfig implements DataFlow::StateConfigSig {
     source.asExpr() instanceof UnzFileVar and
     state = "unzFile"
     or
-    // TO Check
-    exists(FunctionCall fc | fc.getTarget() instanceof MzStreamOpenFunction |
-      fc.getArgument(0).getEnclosingVariable() = source.asVariable() and
-      state = "MzStream"
+    exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_create |
+      fc = source.asExpr() and
+      state = "mz_zip_reader"
     )
     or
-    // TO Check
-    exists(FunctionCall fc | fc.getTarget() instanceof MzStreamOpenFunction |
-      fc.getArgument(0).getEnclosingVariable() = source.asVariable() and
-      state = "MzStream"
+    exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_create |
+      fc = source.asExpr() and
+      state = "mz_zip"
     )
   }
 
   predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
     exists(FunctionCall fc | fc.getTarget() instanceof UnzReadCurrentFileFunction |
       fc.getArgument(0) = sink.asExpr() and
       state = "unzFile"
-      // and not sanitizer(fc)
+    )
+    or
+    exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
+      fc.getArgument(1) = sink.asExpr() and
+      state = "mz_zip_reader"
+    )
+    or
+    exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
+      fc.getArgument(1) = sink.asExpr() and
+      state = "mz_zip"
     )
   }
 
@@ -86,12 +123,25 @@ module MiniZipTaintConfig implements DataFlow::StateConfigSig {
       state1 = "" and
       state2 = "unzFile"
     )
+    or
+    exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_reader_entry |
+      node1.asExpr() = fc.getArgument(0) and
+      node2.asExpr() = fc.getArgument(1) and
+      state1 = "" and
+      state2 = "mz_zip_reader"
+    )
+    or
+    exists(FunctionCall fc | fc.getTarget() instanceof Mz_zip_entry |
+      node1.asExpr() = fc.getArgument(0) and
+      node2.asExpr() = fc.getArgument(1) and
+      state1 = "" and
+      state2 = "mz_zip"
+    )
   }
 
   predicate isBarrier(DataFlow::Node node, DataFlow::FlowState state) { none() }
 }
 
-
 module MiniZipTaint = TaintTracking::GlobalWithState<MiniZipTaintConfig>;
 
 import MiniZipTaint::PathGraph