Skip to content

Commit 51d9162

Browse files
geoffw0geoffw0
committed
C++: Another test.
1 parent 3d19e2a commit 51d9162

File tree

5 files changed

+47
-12
lines changed

5 files changed

+47
-12
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/BadlyBoundedWrite.expected

+2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
1+
| tests.cpp:1056:2:1056:8 | call to strncpy | This 'call to strncpy' operation is limited to 63 bytes but the destination is only -64 bytes. |
2+
| tests.cpp:1057:2:1057:8 | call to strncpy | This 'call to strncpy' operation is limited to 131 bytes but the destination is only -64 bytes. |
13
| var_size_struct.cpp:73:3:73:9 | call to strncpy | This 'call to strncpy' operation is limited to 1025 bytes but the destination is only 1024 bytes. |
24
| var_size_struct.cpp:103:3:103:9 | call to strncpy | This 'call to strncpy' operation is limited to 129 bytes but the destination is only 128 bytes. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.expected

+4
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,10 @@
8888
| tests.cpp:1001:2:1001:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
8989
| tests.cpp:1009:2:1009:9 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:981:6:981:8 | arr | array |
9090
| tests.cpp:1031:2:1031:7 | call to memset | This 'memset' operation accesses 130 bytes but the $@ is only 120 bytes. | tests.cpp:1020:12:1020:15 | arr1 | destination buffer |
91+
| tests.cpp:1051:2:1051:7 | call to memset | This 'memset' operation accesses 64 bytes but the $@ is only -64 bytes. | tests.cpp:1041:8:1041:14 | buffer2 | destination buffer |
92+
| tests.cpp:1052:2:1052:7 | call to memset | This 'memset' operation accesses 132 bytes but the $@ is only -64 bytes. | tests.cpp:1041:8:1041:14 | buffer2 | destination buffer |
93+
| tests.cpp:1056:2:1056:8 | call to strncpy | This 'strncpy' operation may access 63 bytes but the $@ is only -64 bytes. | tests.cpp:1041:8:1041:14 | buffer2 | destination buffer |
94+
| tests.cpp:1057:2:1057:8 | call to strncpy | This 'strncpy' operation may access 131 bytes but the $@ is only -64 bytes. | tests.cpp:1041:8:1041:14 | buffer2 | destination buffer |
9195
| tests_restrict.c:12:2:12:7 | call to memcpy | This 'memcpy' operation accesses 2 bytes but the $@ is only 1 byte. | tests_restrict.c:7:6:7:13 | smallbuf | source buffer |
9296
| unions.cpp:26:2:26:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:21:10:21:11 | mu | destination buffer |
9397
| unions.cpp:30:2:30:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowStatic.expected

+2
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,6 @@
55
| tests.cpp:245:42:245:42 | 6 | Potential buffer-overflow: 'global_array_5' has size 5 not 6. |
66
| tests.cpp:351:2:351:14 | access to array | Potential buffer-overflow: 'charArray' has size 10 but 'charArray[10]' may be accessed here. |
77
| tests.cpp:352:17:352:29 | access to array | Potential buffer-overflow: 'charArray' has size 10 but 'charArray[10]' may be accessed here. |
8+
| tests.cpp:1056:26:1056:47 | ... - ... | Potential buffer-overflow: 'buffer2' has size -64 not 63. |
9+
| tests.cpp:1057:26:1057:39 | ... - ... | Potential buffer-overflow: 'buffer2' has size -64 not 131. |
810
| var_size_struct.cpp:103:39:103:41 | 129 | Potential buffer-overflow: 'str' has size 128 not 129. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/UnboundedWrite.expected

+12-12
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,8 @@ edges
2727
| main.cpp:9:29:9:32 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
2828
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | **argv | provenance | |
2929
| main.cpp:9:29:9:32 | tests_restrict_main output argument | main.cpp:10:20:10:23 | *argv | provenance | |
30-
| main.cpp:10:20:10:23 | **argv | tests.cpp:1034:32:1034:35 | **argv | provenance | |
31-
| main.cpp:10:20:10:23 | *argv | tests.cpp:1034:32:1034:35 | *argv | provenance | |
30+
| main.cpp:10:20:10:23 | **argv | tests.cpp:1060:32:1060:35 | **argv | provenance | |
31+
| main.cpp:10:20:10:23 | *argv | tests.cpp:1060:32:1060:35 | *argv | provenance | |
3232
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | **argv | provenance | |
3333
| overflowdestination.cpp:23:45:23:48 | **argv | overflowdestination.cpp:23:45:23:48 | *argv | provenance | |
3434
| test_buffer_overrun.cpp:32:46:32:49 | **argv | test_buffer_overrun.cpp:32:46:32:49 | **argv | provenance | |
@@ -41,12 +41,12 @@ edges
4141
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:14:649:19 | *home | provenance | |
4242
| tests.cpp:649:14:649:14 | *s [*home] | tests.cpp:649:16:649:19 | *home | provenance | |
4343
| tests.cpp:649:16:649:19 | *home | tests.cpp:649:14:649:19 | *home | provenance | |
44-
| tests.cpp:1034:32:1034:35 | **argv | tests.cpp:1059:9:1059:15 | *access to array | provenance | |
45-
| tests.cpp:1034:32:1034:35 | **argv | tests.cpp:1060:9:1060:15 | *access to array | provenance | |
46-
| tests.cpp:1034:32:1034:35 | *argv | tests.cpp:1059:9:1059:15 | *access to array | provenance | |
47-
| tests.cpp:1034:32:1034:35 | *argv | tests.cpp:1060:9:1060:15 | *access to array | provenance | |
48-
| tests.cpp:1059:9:1059:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
49-
| tests.cpp:1060:9:1060:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
44+
| tests.cpp:1060:32:1060:35 | **argv | tests.cpp:1085:9:1085:15 | *access to array | provenance | |
45+
| tests.cpp:1060:32:1060:35 | **argv | tests.cpp:1086:9:1086:15 | *access to array | provenance | |
46+
| tests.cpp:1060:32:1060:35 | *argv | tests.cpp:1085:9:1085:15 | *access to array | provenance | |
47+
| tests.cpp:1060:32:1060:35 | *argv | tests.cpp:1086:9:1086:15 | *access to array | provenance | |
48+
| tests.cpp:1085:9:1085:15 | *access to array | tests.cpp:634:19:634:24 | *source | provenance | |
49+
| tests.cpp:1086:9:1086:15 | *access to array | tests.cpp:643:19:643:24 | *source | provenance | |
5050
| tests_restrict.c:15:41:15:44 | **argv | tests_restrict.c:15:41:15:44 | **argv | provenance | |
5151
| tests_restrict.c:15:41:15:44 | *argv | tests_restrict.c:15:41:15:44 | *argv | provenance | |
5252
nodes
@@ -80,10 +80,10 @@ nodes
8080
| tests.cpp:649:14:649:14 | *s [*home] | semmle.label | *s [*home] |
8181
| tests.cpp:649:14:649:19 | *home | semmle.label | *home |
8282
| tests.cpp:649:16:649:19 | *home | semmle.label | *home |
83-
| tests.cpp:1034:32:1034:35 | **argv | semmle.label | **argv |
84-
| tests.cpp:1034:32:1034:35 | *argv | semmle.label | *argv |
85-
| tests.cpp:1059:9:1059:15 | *access to array | semmle.label | *access to array |
86-
| tests.cpp:1060:9:1060:15 | *access to array | semmle.label | *access to array |
83+
| tests.cpp:1060:32:1060:35 | **argv | semmle.label | **argv |
84+
| tests.cpp:1060:32:1060:35 | *argv | semmle.label | *argv |
85+
| tests.cpp:1085:9:1085:15 | *access to array | semmle.label | *access to array |
86+
| tests.cpp:1086:9:1086:15 | *access to array | semmle.label | *access to array |
8787
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
8888
| tests_restrict.c:15:41:15:44 | **argv | semmle.label | **argv |
8989
| tests_restrict.c:15:41:15:44 | *argv | semmle.label | *argv |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp

+27
Original file line numberDiff line numberDiff line change
@@ -1031,6 +1031,32 @@ void test29() {
10311031
memset(ptr->arr1, 0, sizeof(ptr->arr1) + sizeof(ptr->arr2) + 10); // BAD
10321032
}
10331033

1034+
struct UnionStruct {
1035+
int a;
1036+
union {
1037+
char buffer1[64];
1038+
int b;
1039+
};
1040+
union {
1041+
char buffer2[64];
1042+
int c;
1043+
};
1044+
};
1045+
1046+
void test30() {
1047+
UnionStruct us;
1048+
1049+
memset(us.buffer1, 0, sizeof(us.buffer1)); // GOOD
1050+
memset(us.buffer1, 0, sizeof(us)); // BAD [NOT DETECTED]
1051+
memset(us.buffer2, 0, sizeof(us.buffer2)); // GOOD [FALSE POSITIVE]
1052+
memset(us.buffer2, 0, sizeof(us)); // BAD
1053+
1054+
strncpy(us.buffer1, "", sizeof(us.buffer1) - 1); // GOOD
1055+
strncpy(us.buffer1, "", sizeof(us) - 1); // BAD [NOT DETECTED]
1056+
strncpy(us.buffer2, "", sizeof(us.buffer2) - 1); // GOOD [FALSE POSITIVE]
1057+
strncpy(us.buffer2, "", sizeof(us) - 1); // BAD
1058+
}
1059+
10341060
int tests_main(int argc, char *argv[])
10351061
{
10361062
long long arr17[19];
@@ -1062,6 +1088,7 @@ int tests_main(int argc, char *argv[])
10621088
test27(argc);
10631089
test28();
10641090
test29();
1091+
test30();
10651092

10661093
return 0;
10671094
}

0 commit comments

Comments
 (0)