Skip to content

Commit 997ab2c

Browse files
krishnprakashkrishnprakash
authored
Merge branch 'github:main' into main-1
2 parents a7d3feb + 5c3f21b commit 997ab2c

File tree

391 files changed

+7440
-5245
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

391 files changed

+7440
-5245
lines changed

‎Cargo.lock

Lines changed: 242 additions & 193 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎MODULE.bazel

Lines changed: 53 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,9 @@ bazel_dep(name = "buildifier_prebuilt", version = "6.4.0", dev_dependency = True
3535

3636
# Keep edition and version approximately in sync with internal repo.
3737
# the versions there are canonical, the versions here are used for CI in github/codeql, as well as for the vendoring of dependencies.
38-
RUST_EDITION = "2021"
38+
RUST_EDITION = "2024"
3939

40-
RUST_VERSION = "1.82.0"
40+
RUST_VERSION = "1.85.0"
4141

4242
rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
4343
rust.toolchain(
@@ -71,57 +71,57 @@ use_repo(
7171
tree_sitter_extractors_deps = use_extension("//misc/bazel/3rdparty:tree_sitter_extractors_extension.bzl", "r")
7272
use_repo(
7373
tree_sitter_extractors_deps,
74-
"vendor__anyhow-1.0.95",
75-
"vendor__argfile-0.2.1",
76-
"vendor__chrono-0.4.39",
77-
"vendor__clap-4.5.26",
78-
"vendor__dunce-1.0.5",
79-
"vendor__either-1.13.0",
80-
"vendor__encoding-0.2.33",
81-
"vendor__figment-0.10.19",
82-
"vendor__flate2-1.0.35",
83-
"vendor__glob-0.3.2",
84-
"vendor__globset-0.4.15",
85-
"vendor__itertools-0.14.0",
86-
"vendor__lazy_static-1.5.0",
87-
"vendor__mustache-0.9.0",
88-
"vendor__num-traits-0.2.19",
89-
"vendor__num_cpus-1.16.0",
90-
"vendor__proc-macro2-1.0.93",
91-
"vendor__quote-1.0.38",
92-
"vendor__ra_ap_base_db-0.0.258",
93-
"vendor__ra_ap_cfg-0.0.258",
94-
"vendor__ra_ap_hir-0.0.258",
95-
"vendor__ra_ap_hir_def-0.0.258",
96-
"vendor__ra_ap_hir_expand-0.0.258",
97-
"vendor__ra_ap_ide_db-0.0.258",
98-
"vendor__ra_ap_intern-0.0.258",
99-
"vendor__ra_ap_load-cargo-0.0.258",
100-
"vendor__ra_ap_parser-0.0.258",
101-
"vendor__ra_ap_paths-0.0.258",
102-
"vendor__ra_ap_project_model-0.0.258",
103-
"vendor__ra_ap_span-0.0.258",
104-
"vendor__ra_ap_stdx-0.0.258",
105-
"vendor__ra_ap_syntax-0.0.258",
106-
"vendor__ra_ap_vfs-0.0.258",
107-
"vendor__rand-0.8.5",
108-
"vendor__rayon-1.10.0",
109-
"vendor__regex-1.11.1",
110-
"vendor__serde-1.0.217",
111-
"vendor__serde_json-1.0.135",
112-
"vendor__serde_with-3.12.0",
113-
"vendor__syn-2.0.96",
114-
"vendor__toml-0.8.19",
115-
"vendor__tracing-0.1.41",
116-
"vendor__tracing-flame-0.2.0",
117-
"vendor__tracing-subscriber-0.3.19",
118-
"vendor__tree-sitter-0.24.6",
119-
"vendor__tree-sitter-embedded-template-0.23.2",
120-
"vendor__tree-sitter-json-0.24.8",
121-
"vendor__tree-sitter-ql-0.23.1",
122-
"vendor__tree-sitter-ruby-0.23.1",
123-
"vendor__triomphe-0.1.14",
124-
"vendor__ungrammar-1.16.1",
74+
"vendor_ts__anyhow-1.0.96",
75+
"vendor_ts__argfile-0.2.1",
76+
"vendor_ts__chrono-0.4.39",
77+
"vendor_ts__clap-4.5.31",
78+
"vendor_ts__dunce-1.0.5",
79+
"vendor_ts__either-1.14.0",
80+
"vendor_ts__encoding-0.2.33",
81+
"vendor_ts__figment-0.10.19",
82+
"vendor_ts__flate2-1.1.0",
83+
"vendor_ts__glob-0.3.2",
84+
"vendor_ts__globset-0.4.15",
85+
"vendor_ts__itertools-0.14.0",
86+
"vendor_ts__lazy_static-1.5.0",
87+
"vendor_ts__mustache-0.9.0",
88+
"vendor_ts__num-traits-0.2.19",
89+
"vendor_ts__num_cpus-1.16.0",
90+
"vendor_ts__proc-macro2-1.0.93",
91+
"vendor_ts__quote-1.0.38",
92+
"vendor_ts__ra_ap_base_db-0.0.266",
93+
"vendor_ts__ra_ap_cfg-0.0.266",
94+
"vendor_ts__ra_ap_hir-0.0.266",
95+
"vendor_ts__ra_ap_hir_def-0.0.266",
96+
"vendor_ts__ra_ap_hir_expand-0.0.266",
97+
"vendor_ts__ra_ap_ide_db-0.0.266",
98+
"vendor_ts__ra_ap_intern-0.0.266",
99+
"vendor_ts__ra_ap_load-cargo-0.0.266",
100+
"vendor_ts__ra_ap_parser-0.0.266",
101+
"vendor_ts__ra_ap_paths-0.0.266",
102+
"vendor_ts__ra_ap_project_model-0.0.266",
103+
"vendor_ts__ra_ap_span-0.0.266",
104+
"vendor_ts__ra_ap_stdx-0.0.266",
105+
"vendor_ts__ra_ap_syntax-0.0.266",
106+
"vendor_ts__ra_ap_vfs-0.0.266",
107+
"vendor_ts__rand-0.9.0",
108+
"vendor_ts__rayon-1.10.0",
109+
"vendor_ts__regex-1.11.1",
110+
"vendor_ts__serde-1.0.218",
111+
"vendor_ts__serde_json-1.0.139",
112+
"vendor_ts__serde_with-3.12.0",
113+
"vendor_ts__syn-2.0.98",
114+
"vendor_ts__toml-0.8.20",
115+
"vendor_ts__tracing-0.1.41",
116+
"vendor_ts__tracing-flame-0.2.0",
117+
"vendor_ts__tracing-subscriber-0.3.19",
118+
"vendor_ts__tree-sitter-0.24.6",
119+
"vendor_ts__tree-sitter-embedded-template-0.23.2",
120+
"vendor_ts__tree-sitter-json-0.24.8",
121+
"vendor_ts__tree-sitter-ql-0.23.1",
122+
"vendor_ts__tree-sitter-ruby-0.23.1",
123+
"vendor_ts__triomphe-0.1.14",
124+
"vendor_ts__ungrammar-1.16.1",
125125
)
126126

127127
http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

‎actions/extractor/BUILD.bazel

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ codeql_pkg_files(
55
srcs = [
66
"codeql-extractor.yml",
77
"//:LICENSE",
8-
] + glob(["tools/**"]),
8+
],
9+
exes = glob(["tools/**"]),
910
strip_prefix = strip_prefix.from_pkg(),
1011
visibility = ["//actions:__pkg__"],
1112
)

‎cpp/ql/lib/change-notes/2025-02-20-getbuffersize.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Fixed an issue where the `getBufferSize` predicate in `commons/Buffer.qll` was returning results for references inside `offsetof` expressions, which are not accesses to a buffer.

‎cpp/ql/lib/change-notes/2025-02-25-getbuffersize.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Modified the `getBufferSize` predicate in `commons/Buffer.qll` to be more tolerant in some cases involving member variables in a larger struct or class.

‎cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ private int getSize(VariableAccess va) {
7171
result = t.getSize()
7272
)
7373
or
74-
exists(Class c |
74+
exists(Class c, int trueSize |
7575
// Otherwise, we find the "outermost" object and compute the size
7676
// as the difference between the size of the type of the "outermost
7777
// object" and the offset of the field relative to that type.
@@ -91,7 +91,9 @@ private int getSize(VariableAccess va) {
9191
// of `y` relative to the type `S2` (i.e., `4`). So the size of the
9292
// buffer is `12 - 4 = 8`.
9393
c = getRootType(va) and
94-
result = c.getSize() - v.(Field).getOffsetInClass(c)
94+
// we calculate the size based on the last field, to avoid including any padding after it
95+
trueSize = max(Field f | | f.getOffsetInClass(c) + f.getUnspecifiedType().getSize()) and
96+
result = trueSize - v.(Field).getOffsetInClass(c)
9597
)
9698
)
9799
}
@@ -105,9 +107,16 @@ private int getSize(VariableAccess va) {
105107
private int isSource(Expr bufferExpr, Element why) {
106108
exists(Variable bufferVar | bufferVar = bufferExpr.(VariableAccess).getTarget() |
107109
// buffer is a fixed size array
108-
result = bufferVar.getUnspecifiedType().(ArrayType).getSize() and
110+
exists(bufferVar.getUnspecifiedType().(ArrayType).getSize()) and
111+
result =
112+
unique(int size | // more generous than .getSize() itself, when the array is a class field or similar.
113+
size = getSize(bufferExpr)
114+
|
115+
size
116+
) and
109117
why = bufferVar and
110118
not memberMayBeVarSize(_, bufferVar) and
119+
not exists(BuiltInOperationBuiltInOffsetOf offsetof | offsetof.getAChild*() = bufferExpr) and
111120
// zero sized arrays are likely to have special usage, for example
112121
// behaving a bit like a 'union' overlapping other fields.
113122
not result = 0

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1520,16 +1520,17 @@ private EdgeKind caseOrDefaultEdge() {
15201520
private int countNumberOfBranchesUsingParameter(SwitchInstruction switch, ParameterNode p) {
15211521
exists(Ssa::SourceVariable sv |
15221522
parameterNodeHasSourceVariable(p, sv) and
1523-
// Count the number of cases that use the parameter. We do this by finding the phi node
1524-
// that merges the uses/defs of the parameter. There might be multiple such phi nodes, so
1525-
// we pick the one with the highest edge count.
1523+
// Count the number of cases that use the parameter.
15261524
result =
1527-
max(SsaPhiNode phi |
1528-
switch.getSuccessor(caseOrDefaultEdge()).getBlock().dominanceFrontier() =
1529-
phi.getBasicBlock() and
1530-
phi.getSourceVariable() = sv
1531-
|
1532-
strictcount(phi.getAnInput())
1525+
strictcount(IRBlock caseblock |
1526+
exists(IRBlock useblock |
1527+
switch.getSuccessor(caseOrDefaultEdge()).getBlock() = caseblock and
1528+
caseblock.dominates(useblock)
1529+
|
1530+
exists(Ssa::UseImpl use | use.hasIndexInBlock(useblock, _, sv))
1531+
or
1532+
exists(Ssa::DefImpl def | def.hasIndexInBlock(useblock, _, sv))
1533+
)
15331534
)
15341535
)
15351536
}

‎cpp/ql/src/Metrics/Internal/IncludeResolutionStatus.ql

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
/**
2+
* @name Include file resolution status
3+
* @description A count of successful includes and includes that failed to resolve.
4+
* This query is for internal use only and may change without notice.
5+
* @kind table
6+
* @id cpp/include-resolution-status
7+
*/
8+
9+
import cpp
10+
11+
/**
12+
* A cannot open file error.
13+
*
14+
* Typically this is due to a missing include.
15+
*/
16+
class CannotOpenFileError extends CompilerError {
17+
CannotOpenFileError() { this.hasTag(["cannot_open_file", "cannot_open_file_reason"]) }
18+
}
19+
20+
select count(CannotOpenFileError e) as failed_includes, count(Include i) as successful_includes

‎cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,9 @@
55
* buffer.
66
* @kind problem
77
* @id cpp/overflow-buffer
8-
* @problem.severity recommendation
8+
* @problem.severity warning
99
* @security-severity 9.3
10+
* @precision medium
1011
* @tags security
1112
* external/cwe/cwe-119
1213
* external/cwe/cwe-121

‎cpp/ql/src/change-notes/2025-02-20-overflow-buffer.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The query "Call to memory access function may overflow buffer" (`cpp/overflow-buffer`) has been added to the security-extended query suite. The query detects a range of buffer overflow and underflow issues.

‎cpp/ql/src/change-notes/2025-02-27-static-buffer-overflow.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Due to changes in libraries the query "Static array access may cause overflow" (`cpp/static-buffer-overflow`) will no longer report cases where multiple fields of a struct or class are written with a single `memset` or similar operation.

‎cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.expected

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
| test.cpp:3:8:3:8 | C<1> | 0 | int | test.cpp:5:25:5:25 | 1 |
2-
| test.cpp:3:8:3:8 | C<2> | 0 | int | file://:0:0:0:0 | 2 |
3-
| test.cpp:3:8:3:8 | C<x> | 0 | int | file://:0:0:0:0 | x |
4-
| test.cpp:10:8:10:8 | D<T, X> | 0 | <none> | test.cpp:9:19:9:19 | T |
5-
| test.cpp:10:8:10:8 | D<T, X> | 1 | T | file://:0:0:0:0 | X |
6-
| test.cpp:10:8:10:8 | D<int, 2> | 0 | <none> | file://:0:0:0:0 | int |
7-
| test.cpp:10:8:10:8 | D<int, 2> | 1 | int | test.cpp:12:8:12:8 | 2 |
8-
| test.cpp:10:8:10:8 | D<long, 2L> | 0 | <none> | file://:0:0:0:0 | long |
9-
| test.cpp:10:8:10:8 | D<long, 2L> | 1 | long | file://:0:0:0:0 | 2 |
10-
| test.cpp:16:8:16:8 | E<T, X> | 0 | <none> | test.cpp:15:19:15:19 | T |
11-
| test.cpp:16:8:16:8 | E<T, X> | 1 | T * | file://:0:0:0:0 | X |
12-
| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 0 | <none> | file://:0:0:0:0 | int |
13-
| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 1 | int * | file://:0:0:0:0 | 0 |
1+
| test.cpp:3:8:3:8 | C<1> | 0 | int | test.cpp:5:25:5:25 | 1 | 1 |
2+
| test.cpp:3:8:3:8 | C<2> | 0 | int | file://:0:0:0:0 | 2 | 2 |
3+
| test.cpp:3:8:3:8 | C<x> | 0 | int | file://:0:0:0:0 | x | x |
4+
| test.cpp:10:8:10:8 | D<T, X> | 0 | <none> | test.cpp:9:19:9:19 | T | <none> |
5+
| test.cpp:10:8:10:8 | D<T, X> | 1 | T | file://:0:0:0:0 | X | X |
6+
| test.cpp:10:8:10:8 | D<int, 2> | 0 | <none> | file://:0:0:0:0 | int | <none> |
7+
| test.cpp:10:8:10:8 | D<int, 2> | 1 | int | test.cpp:12:8:12:8 | 2 | 2 |
8+
| test.cpp:10:8:10:8 | D<long, 2L> | 0 | <none> | file://:0:0:0:0 | long | <none> |
9+
| test.cpp:10:8:10:8 | D<long, 2L> | 1 | long | file://:0:0:0:0 | 2 | 2 |
10+
| test.cpp:16:8:16:8 | E<T, X> | 0 | <none> | test.cpp:15:19:15:19 | T | <none> |
11+
| test.cpp:16:8:16:8 | E<T, X> | 1 | T * | file://:0:0:0:0 | X | X |
12+
| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 0 | <none> | file://:0:0:0:0 | int | <none> |
13+
| test.cpp:16:8:16:8 | E<int, (int *)nullptr> | 1 | int * | file://:0:0:0:0 | 0 | 0 |

‎cpp/ql/test/library-tests/templates/nontype_instantiations/general/test.ql

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,16 @@ string maybeGetTemplateArgumentKind(Declaration d, int i) {
99
i = [0 .. d.getNumberOfTemplateArguments()]
1010
}
1111

12+
string maybeGetTemplateArgumentValue(Declaration d, int i) {
13+
(
14+
if exists(d.getTemplateArgument(i).(Expr).getValue())
15+
then result = d.getTemplateArgument(i).(Expr).getValue()
16+
else result = "<none>"
17+
) and
18+
i = [0 .. d.getNumberOfTemplateArguments()]
19+
}
20+
1221
from Declaration d, int i
1322
where i >= 0 and i < d.getNumberOfTemplateArguments()
14-
select d, i, maybeGetTemplateArgumentKind(d, i), d.getTemplateArgument(i)
23+
select d, i, maybeGetTemplateArgumentKind(d, i), d.getTemplateArgument(i),
24+
maybeGetTemplateArgumentValue(d, i)

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowBuffer.expected

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
| tests.cpp:45:9:45:14 | call to memcpy | This 'memcpy' operation accesses 32 bytes but the $@ is only 16 bytes. | tests.cpp:32:10:32:18 | charFirst | destination buffer |
2-
| tests.cpp:60:9:60:14 | call to memcpy | This 'memcpy' operation accesses 32 bytes but the $@ is only 16 bytes. | tests.cpp:32:10:32:18 | charFirst | destination buffer |
31
| tests.cpp:171:9:171:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:164:20:164:25 | call to malloc | destination buffer |
42
| tests.cpp:172:9:172:19 | access to array | This array indexing operation accesses byte offset 99 but the $@ is only 50 bytes. | tests.cpp:164:20:164:25 | call to malloc | array |
53
| tests.cpp:192:9:192:14 | call to memcpy | This 'memcpy' operation accesses 100 bytes but the $@ is only 50 bytes. | tests.cpp:181:10:181:22 | dataBadBuffer | destination buffer |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/OverflowStatic.expected

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +0,0 @@
1-
| tests.cpp:45:51:45:72 | sizeof(<expr>) | Potential buffer-overflow: 'charFirst' has size 16 not 32. |
2-
| tests.cpp:60:52:60:74 | sizeof(<expr>) | Potential buffer-overflow: 'charFirst' has size 16 not 32. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/tests.cpp

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ void CWE121_Stack_Based_Buffer_Overflow__char_type_overrun_memcpy_01_bad()
4242
/* Print the initial block pointed to by structCharVoid.voidSecond */
4343
printLine((char *)structCharVoid.voidSecond);
4444
/* FLAW: Use the sizeof(structCharVoid) which will overwrite the pointer voidSecond */
45-
memcpy(structCharVoid.charFirst, SRC_STR, sizeof(structCharVoid));
45+
memcpy(structCharVoid.charFirst, SRC_STR, sizeof(structCharVoid)); // [NOT DETECTED]
4646
structCharVoid.charFirst[(sizeof(structCharVoid.charFirst)/sizeof(char))-1] = '\0'; /* null terminate the string */
4747
printLine((char *)structCharVoid.charFirst);
4848
printLine((char *)structCharVoid.voidSecond);
@@ -57,7 +57,7 @@ void CWE122_Heap_Based_Buffer_Overflow__char_type_overrun_memcpy_01_bad()
5757
/* Print the initial block pointed to by structCharVoid->voidSecond */
5858
printLine((char *)structCharVoid->voidSecond);
5959
/* FLAW: Use the sizeof(*structCharVoid) which will overwrite the pointer y */
60-
memcpy(structCharVoid->charFirst, SRC_STR, sizeof(*structCharVoid));
60+
memcpy(structCharVoid->charFirst, SRC_STR, sizeof(*structCharVoid)); // [NOT DETECTED]
6161
structCharVoid->charFirst[(sizeof(structCharVoid->charFirst)/sizeof(char))-1] = '\0'; /* null terminate the string */
6262
printLine((char *)structCharVoid->charFirst);
6363
printLine((char *)structCharVoid->voidSecond);
@@ -292,7 +292,7 @@ namespace CWE122_Heap_Based_Buffer_Overflow__cpp_CWE193_wchar_t_ncpy_01
292292
delete [] data;
293293
}
294294
}
295-
295+
296296
static void goodG2B()
297297
{
298298
wchar_t * data;
@@ -459,7 +459,7 @@ void CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_ncpy_01_bad()
459459
#ifdef _WIN32
460460
int _snwprintf(wchar_t *buffer, size_t count, const wchar_t *format, ...);
461461
#define SNPRINTF _snwprintf
462-
#else
462+
#else
463463
int snprintf(char *s, size_t n, const char *format, ...);
464464
int swprintf(wchar_t *wcs, size_t maxlen, const wchar_t *format, ...);
465465
//#define SNPRINTF snprintf --- original code; using snprintf appears to be a mistake in samate?
@@ -485,14 +485,14 @@ void CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_snprintf_01_bad()
485485
}
486486

487487
/* classes used in some test cases as a custom type */
488-
class TwoIntsClass
488+
class TwoIntsClass
489489
{
490490
public: // Needed to access variables from label files
491491
int intOne;
492492
int intTwo;
493493
};
494494

495-
class OneIntClass
495+
class OneIntClass
496496
{
497497
public: // Needed to access variables from label files
498498
int intOne;
@@ -636,7 +636,7 @@ void CWE122_Heap_Based_Buffer_Overflow__cpp_CWE805_wchar_t_snprintf_31_bad()
636636

637637
int rand(void);
638638

639-
int globalReturnsTrueOrFalse()
639+
int globalReturnsTrueOrFalse()
640640
{
641641
return (rand() % 2);
642642
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/BadlyBoundedWrite.expected

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
1+
| tests.cpp:1055:2:1055:8 | call to strncpy | This 'call to strncpy' operation is limited to 131 bytes but the destination is only 128 bytes. |
2+
| tests.cpp:1057:2:1057:8 | call to strncpy | This 'call to strncpy' operation is limited to 131 bytes but the destination is only 64 bytes. |
13
| var_size_struct.cpp:73:3:73:9 | call to strncpy | This 'call to strncpy' operation is limited to 1025 bytes but the destination is only 1024 bytes. |
24
| var_size_struct.cpp:103:3:103:9 | call to strncpy | This 'call to strncpy' operation is limited to 129 bytes but the destination is only 128 bytes. |

0 commit comments

Comments
 (0)