/**

* @name CWE-120

* @description Buffer Copy without Checking Size of Input ('Classic Buffer Overflow').

* @kind problem

* @problem.severity recommendation

*/

import cpp

import semmle.code.cpp.commons.Buffer

import semmle.code.cpp.commons.Scanf

import semmle.code.cpp.models.implementations.Strcat

import semmle.code.cpp.models.implementations.Strcpy

/*

* --- BufferWrite framework ---

*/

/**

* An operation that writes a variable amount of data to a buffer

* (strcpy, strncat, sprintf etc).

*

* Note that there are two related class frameworks:

* - BufferWrite provides detailed coverage of null-terminated

* buffer write operations.

* - BufferAccess provides general coverage of buffer read and write

* operations whose size is either not data-dependent, or has an upper

* bound which is not data-dependent.

* This design has some overlaps between the two classes, for example

* the write of a 'strncpy'.

*/

abstract class BufferWrite extends Expr {

/*

* --- derived classes override these ---

*/

/**

* Gets the (unspecified) type of the buffer this operation works

* with (for example `char *`).

*/

abstract Type getBufferType();

/**

* Gets a data source of this operation (e.g. the source string,

* format string; not necessarily copied as-is).

*/

Expr getASource() { none() }

/**

* Gets the destination buffer of this operation.

*/

abstract Expr getDest();

/**

* Holds if the operation has an explicit parameter that limits the amount

* of data written (e.g. `strncpy` does, whereas `strcpy` does not); this

* is not the same as exists(getExplicitLimit()) because the limit may exist

* though it's value is unknown.

*/

predicate hasExplicitLimit() { none() }

/**

* Gets the explicit limit of bytes copied by this operation, if it exists

* and it's value can be determined.

*/

int getExplicitLimit() { none() }

/**

* Gets an upper bound to the amount of data that's being written (if one

* can be found).

*/

int getMaxData() { none() }

/**

* Gets an upper bound to the amount of data that's being written (if one

* can be found), specifying the reason for the estimation.

*/

int getMaxData(BufferWriteEstimationReason reason) {

reason instanceof UnspecifiedEstimateReason and result = this.getMaxData()

}

/**

* Gets an upper bound to the amount of data that's being written (if one

* can be found), except that float to string conversions are assumed to be

* much smaller (8 bytes) than their true maximum length. This can be

* helpful in determining the cause of a buffer overflow issue.

*/

int getMaxDataLimited() { result = this.getMaxData() }

/**

* Gets an upper bound to the amount of data that's being written (if one

* can be found), specifying the reason for the estimation, except that

* float to string conversions are assumed to be much smaller (8 bytes)

* than their true maximum length. This can be helpful in determining the

* cause of a buffer overflow issue.

*/

int getMaxDataLimited(BufferWriteEstimationReason reason) { result = this.getMaxData(reason) }

/**

* Gets the size of a single character of the type this

* operation works with, in bytes.

*/

int getCharSize() {

result = this.getBufferType().(PointerType).getBaseType().getSize() or

result = this.getBufferType().(ArrayType).getBaseType().getSize()

}

/**

* Gets a description of this buffer write.

*/

string getBWDesc() { result = this.toString() }

}

/**

* A `BufferWrite` that is also a `FunctionCall` (most cases).

*/

abstract class BufferWriteCall extends BufferWrite, FunctionCall { }

/*

* --- BufferWrite classes ---

*/

/**

* A call to a variant of `strcpy`.

*/

class StrCopyBW extends BufferWriteCall {

StrcpyFunction f;

StrCopyBW() { this.getTarget() = f.(TopLevelFunction) }

/**

* Gets the index of the parameter that is the maximum size of the copy (in characters).

*/

int getParamSize() { result = f.getParamSize() }

/**

* Gets the index of the parameter that is the source of the copy.

*/

int getParamSrc() { result = f.getParamSrc() }

override Type getBufferType() {

result = this.getTarget().getParameter(this.getParamSrc()).getUnspecifiedType()

}

override Expr getASource() { result = this.getArgument(this.getParamSrc()) }

override Expr getDest() { result = this.getArgument(f.getParamDest()) }

override predicate hasExplicitLimit() { exists(this.getParamSize()) }

override int getExplicitLimit() {

result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()

}

private int getMaxDataImpl(BufferWriteEstimationReason reason) {

// when result exists, it is an exact flow analysis

reason instanceof ValueFlowAnalysis and

result =

this.getArgument(this.getParamSrc()).(AnalyzedString).getMaxLength() * this.getCharSize()

}

override int getMaxData(BufferWriteEstimationReason reason) {

result = this.getMaxDataImpl(reason)

}

override int getMaxData() { result = max(this.getMaxDataImpl(_)) }

}

/**

* A call to a variant of `strcat`.

*/

class StrCatBW extends BufferWriteCall {

StrcatFunction f;

StrCatBW() { this.getTarget() = f.(TopLevelFunction) }

/**

* Gets the index of the parameter that is the maximum size of the copy (in characters).

*/

int getParamSize() { result = f.getParamSize() }

/**

* Gets the index of the parameter that is the source of the copy.

*/

int getParamSrc() { result = f.getParamSrc() }

override Type getBufferType() {

result = this.getTarget().getParameter(this.getParamSrc()).getUnspecifiedType()

}

override Expr getASource() { result = this.getArgument(this.getParamSrc()) }

override Expr getDest() { result = this.getArgument(f.getParamDest()) }

override predicate hasExplicitLimit() { exists(this.getParamSize()) }

override int getExplicitLimit() {

result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()

}

private int getMaxDataImpl(BufferWriteEstimationReason reason) {

// when result exists, it is an exact flow analysis

reason instanceof ValueFlowAnalysis and

result =

this.getArgument(this.getParamSrc()).(AnalyzedString).getMaxLength() * this.getCharSize()

}

override int getMaxData(BufferWriteEstimationReason reason) {

result = this.getMaxDataImpl(reason)

}

override int getMaxData() { result = max(this.getMaxDataImpl(_)) }

}

/**

* A call to a variant of `sprintf`.

*/

class SprintfBW extends BufferWriteCall {

FormattingFunction f;

SprintfBW() {

exists(string name | f = this.getTarget().(TopLevelFunction) and name = f.getName() |

/*

* C sprintf variants:

*/

// sprintf(dst, format, args...)

name = "sprintf"

or

// vsprintf(dst, format, va_list)

name = "vsprintf"

or

// wsprintf(dst, format, args...)

name = "wsprintf"

or

// vwsprintf(dst, format, va_list)

name = "vwsprintf"

or

/*

* Microsoft sprintf variants:

*/

// _sprintf_l(dst, format, locale, args...)

name.regexpMatch("_sprintf_l")

or

// _vsprintf_l(dst, format, locale, va_list))

name.regexpMatch("_vsprintf_l")

or

// __swprintf_l(dst, format, locale, args...)

name.regexpMatch("__swprintf_l")

or

// __vswprintf_l(dst, format, locale, va_list)

name.regexpMatch("__vswprintf_l")

)

}

override Type getBufferType() {

result = f.getParameter(f.getFormatParameterIndex()).getUnspecifiedType()

}

override Expr getASource() {

result = this.(FormattingFunctionCall).getFormat()

or

result = this.(FormattingFunctionCall).getFormatArgument(_)

}

override Expr getDest() { result = this.getArgument(f.getOutputParameterIndex(false)) }

private int getMaxDataImpl(BufferWriteEstimationReason reason) {

exists(FormatLiteral fl |

fl = this.(FormattingFunctionCall).getFormat() and

result = fl.getMaxConvertedLengthWithReason(reason) * this.getCharSize()

)

}

override int getMaxData(BufferWriteEstimationReason reason) {

result = this.getMaxDataImpl(reason)

}

override int getMaxData() { result = max(this.getMaxDataImpl(_)) }

private int getMaxDataLimitedImpl(BufferWriteEstimationReason reason) {

exists(FormatLiteral fl |

fl = this.(FormattingFunctionCall).getFormat() and

result = fl.getMaxConvertedLengthLimitedWithReason(reason) * this.getCharSize()

)

}

override int getMaxDataLimited(BufferWriteEstimationReason reason) {

result = this.getMaxDataLimitedImpl(reason)

}

override int getMaxDataLimited() { result = max(this.getMaxDataLimitedImpl(_)) }

}

/**

* A call to a variant of `snprintf`.

*/

class SnprintfBW extends BufferWriteCall {

SnprintfBW() {

exists(TopLevelFunction fn, string name | fn = this.getTarget() and name = fn.getName() |

/*

* C snprintf variants:

*/

// snprintf(dst, max_amount, format, args...)

name = "snprintf"

or

// vsnprintf(dst, max_amount, format, va_list)

name = "vsnprintf"

or

// swprintf(dst, max_amount, format, args...)

name = "swprintf"

or

// vswprintf(dst, max_amount, format, va_list)

name = "vswprintf"

or

/*

* Microsoft snprintf variants:

*/

// sprintf_s(dst, max_amount, format, locale, args...)

name = "sprintf_s"

or

// vsprintf_s(dst, max_amount, format, va_list)

name = "vsprintf_s"

or

// swprintf_s(dst, max_amount, format, args...)

name = "swprintf_s"

or

// vswprintf_s(dst, max_amount, format, va_list)

name = "vswprintf_s"

or

// Microsoft snprintf variants with '_':

// _sprintf_s_l(dst, max_amount, format, locale, args...)

// _swprintf_l(dst, max_amount, format, locale, args...)

// _swprintf_s_l(dst, max_amount, format, locale, args...)

// _snprintf(dst, max_amount, format, args...)

// _snprintf_l(dst, max_amount, format, locale, args...)

// _snwprintf(dst, max_amount, format, args...)

// _snwprintf_l(buffer, max_amount, format, locale, args...)

// _vsprintf_s_l(dst, max_amount, format, locale, va_list)

// _vsprintf_p(dst, max_amount, format, va_list)

// _vsprintf_p_l(dst, max_amount, format, locale, va_list)

// _vswprintf_l(dst, max_amount, format, locale, va_list)

// _vswprintf_s_l(buffer, max_amount, format, locale, va_list)

// _vswprintf_p(dst, max_amount, format, va_list)

// _vswprintf_p_l(dst, max_amount, format, locale, va_list)

// _vsnprintf(dst, max_amount, format, va_list)

// _vsnprintf_l(dst, max_amount, format, locale, va_list)

// _vsnwprintf(dst, max_amount, format, va_list)

// _vsnwprintf_l(dst, max_amount, format, locale, va_list)

name.regexpMatch("_v?sn?w?printf(_s)?(_p)?(_l)?") and

not this instanceof SprintfBW

)

}

/**

* Gets the index of the parameter that is the size of the destination (in characters).

*/

int getParamSize() { result = 1 }

override Type getBufferType() {

exists(FormattingFunction f |

f = this.getTarget() and

result = f.getParameter(f.getFormatParameterIndex()).getUnspecifiedType()

)

}

override Expr getASource() {

result = this.(FormattingFunctionCall).getFormat()

or

result = this.(FormattingFunctionCall).getFormatArgument(_)

}

override Expr getDest() { result = this.getArgument(0) }

override predicate hasExplicitLimit() { exists(this.getParamSize()) }

override int getExplicitLimit() {

result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()

}

private int getMaxDataImpl(BufferWriteEstimationReason reason) {

exists(FormatLiteral fl |

fl = this.(FormattingFunctionCall).getFormat() and

result = fl.getMaxConvertedLengthWithReason(reason) * this.getCharSize()

)

}

override int getMaxData(BufferWriteEstimationReason reason) {

result = this.getMaxDataImpl(reason)

}

override int getMaxData() { result = max(this.getMaxDataImpl(_)) }

private int getMaxDataLimitedImpl(BufferWriteEstimationReason reason) {

exists(FormatLiteral fl |

fl = this.(FormattingFunctionCall).getFormat() and

result = fl.getMaxConvertedLengthLimitedWithReason(reason) * this.getCharSize()

)

}

override int getMaxDataLimited(BufferWriteEstimationReason reason) {

result = this.getMaxDataLimitedImpl(reason)

}

override int getMaxDataLimited() { result = max(this.getMaxDataLimitedImpl(_)) }

}

/**

* A call to a variant of `gets`.

*/

class GetsBW extends BufferWriteCall {

GetsBW() {

this.getTarget().(TopLevelFunction).getName() =

[

"gets", // gets(dst)

"fgets", // fgets(dst, max_amount, src_stream)

"fgetws" // fgetws(dst, max_amount, src_stream)

]

}

/**

* Gets the index of the parameter that is the maximum number of characters to be read.

*/

int getParamSize() { exists(this.getArgument(1)) and result = 1 }

override Type getBufferType() { result = this.getTarget().getParameter(0).getUnspecifiedType() }

override Expr getASource() {

if exists(this.getArgument(2))

then result = this.getArgument(2)

else

// the source is input inside the 'gets' call itself

result = this

}

override Expr getDest() { result = this.getArgument(0) }

override predicate hasExplicitLimit() { exists(this.getParamSize()) }

override int getExplicitLimit() {

result = this.getArgument(this.getParamSize()).getValue().toInt() * this.getCharSize()

}

}

/**

* A string that is written by a `scanf`-like function.

*/

class ScanfBW extends BufferWrite {

ScanfBW() {

exists(ScanfFunctionCall fc, ScanfFormatLiteral fl, int arg, int args_pos |

this = fc.getArgument(arg) and

args_pos = fc.getTarget().getNumberOfParameters() and

arg >= args_pos and

fl = fc.getFormat() and

fl.getConversionChar(arg - args_pos) = "s"

)

}

/**

* Gets the index of the parameter that is the first format argument.

*/

int getParamArgs() {

exists(FunctionCall fc |

this = fc.getArgument(_) and

result = fc.getTarget().getNumberOfParameters()

)

}

override Type getBufferType() {

exists(ScanfFunction f, ScanfFunctionCall fc |

this = fc.getArgument(_) and

f = fc.getTarget() and

result = f.getParameter(f.getFormatParameterIndex()).getUnspecifiedType()

)

}

override Expr getASource() {

exists(ScanfFunctionCall fc |

this = fc.getArgument(_) and

(

// inputs are: the format string, input or the argument itself (if there's no explicit input)

result = fc.getFormat()

or

result = fc.getArgument(fc.getInputParameterIndex())

or

not exists(fc.getInputParameterIndex()) and result = this

)

)

}

override Expr getDest() { result = this }

private int getMaxDataImpl(BufferWriteEstimationReason reason) {

// when this returns, it is based on exact flow analysis

reason instanceof ValueFlowAnalysis and

exists(ScanfFunctionCall fc, ScanfFormatLiteral fl, int arg |

this = fc.getArgument(arg) and

fl = fc.getFormat() and

result = (fl.getMaxConvertedLength(arg - this.getParamArgs()) + 1) * this.getCharSize() // +1 is for the terminating null

)

}

override int getMaxData(BufferWriteEstimationReason reason) {

result = this.getMaxDataImpl(reason)

}

override int getMaxData() { result = max(this.getMaxDataImpl(_)) }

override string getBWDesc() {

exists(FunctionCall fc |

this = fc.getArgument(_) and

result = fc.getTarget().getName() + " string argument"

)

}

}

/**

* A detected definition of PATH_MAX

*/

private int path_max() {

result = max(Macro macro | macro.getName() = "PATH_MAX" | macro.getBody().toInt())

}

/**

* A call to `realpath`.

*/

class RealpathBW extends BufferWriteCall {

RealpathBW() {

exists(path_max()) and // Ignore realpath() calls if PATH_MAX cannot be determined

this.getTarget().hasGlobalName("realpath") // realpath(path, resolved_path);

}

override Type getBufferType() { result = this.getTarget().getParameter(0).getUnspecifiedType() }

override Expr getDest() { result = this.getArgument(1) }

override Expr getASource() { result = this.getArgument(0) }

private int getMaxDataImpl(BufferWriteEstimationReason reason) {

// although there may be some unknown invariants guaranteeing that a real path is shorter than PATH_MAX, we can consider providing less than PATH_MAX a problem with high precision

reason instanceof ValueFlowAnalysis and

result = path_max() and

this = this // Suppress a compiler warning

}

override int getMaxData(BufferWriteEstimationReason reason) {

result = this.getMaxDataImpl(reason)

}

override int getMaxData() { result = max(this.getMaxDataImpl(_)) }

}