Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 30f1547

Browse files
MathiasVPMathiasVP
committed
C++: Use 'max' instead of 'unique.'
1 parent 1b50168 commit 30f1547

4 files changed

Lines changed: 19 additions & 14 deletions

File tree

‎cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ private predicate localFlowToExprStep(DataFlow::Node n1, DataFlow::Node n2) {
8080

8181
/** Holds if `n2 + delta` may be equal to `n1`. */
8282
private predicate localFlowStepToExpr(Expr e1, Expr e2) {
83-
getBufferSize0(e1) and
83+
getBufferSizeCand0(e1) and
8484
exists(DataFlow::Node n1, DataFlow::Node mid, DataFlow::Node n2 |
8585
n1.asExpr() = e1 and
8686
localFlowToExprStep*(n1, mid) and
@@ -95,7 +95,7 @@ private predicate localFlowStepToExpr(Expr e1, Expr e2) {
9595
* expression.
9696
*/
9797
private predicate step(Expr e1, Expr e2, int delta) {
98-
getBufferSize0(e1) and
98+
getBufferSizeCand0(e1) and
9999
exists(Variable bufferVar, Class parentClass, VariableAccess parentPtr, int bufferSize |
100100
e1 = parentPtr
101101
|
@@ -117,27 +117,37 @@ private predicate step(Expr e1, Expr e2, int delta) {
117117
}
118118

119119
pragma[nomagic]
120-
private predicate getBufferSize0(Expr e) {
120+
private predicate getBufferSizeCand0(Expr e) {
121121
exists(isSource(e, _))
122122
or
123123
exists(Expr e0 |
124-
getBufferSize0(e0) and
124+
getBufferSizeCand0(e0) and
125125
step(e0, e, _)
126126
)
127127
}
128128

129129
/**
130130
* Get the size in bytes of the buffer pointed to by an expression (if this can be determined).
131+
*
132+
* NOTE: There can be multiple `(result, why)` for a given `bufferExpr`.
131133
*/
132-
int getBufferSize(Expr bufferExpr, Element why) {
133-
getBufferSize0(bufferExpr) and
134+
private int getBufferSizeCand(Expr bufferExpr, Element why) {
135+
getBufferSizeCand0(bufferExpr) and
134136
(
135137
result = isSource(bufferExpr, why)
136138
or
137139
exists(Expr e0, int delta, int size |
138-
size = getBufferSize(e0, why) and
139-
delta = unique(int cand | step(e0, bufferExpr, cand) | cand) and
140+
size = getBufferSizeCand(e0, why) and
141+
step(e0, bufferExpr, delta) and
140142
result = size + delta
141143
)
142144
)
143145
}
146+
147+
/**
148+
* Get the size in bytes of the buffer pointed to by an expression (if this can be determined).
149+
*/
150+
int getBufferSize(Expr bufferExpr, Element why) {
151+
result = max( | | getBufferSizeCand(bufferExpr, _)) and
152+
result = getBufferSizeCand(bufferExpr, why)
153+
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/SAMATE/VeryLikelyOverrunWrite.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +0,0 @@
1-
| tests.cpp:668:9:668:14 | call to strcpy | This 'call to strcpy' operation requires 11 bytes but the destination is only 10 bytes. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowBuffer.expected‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,6 @@
4848
| tests.cpp:495:2:495:7 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:474:21:474:26 | call to malloc | array |
4949
| tests.cpp:519:3:519:8 | call to memset | This 'memset' operation accesses 20 bytes but the $@ is only 10 bytes. | tests.cpp:502:15:502:20 | call to malloc | destination buffer |
5050
| tests.cpp:519:3:519:8 | call to memset | This 'memset' operation accesses 20 bytes but the $@ is only 10 bytes. | tests.cpp:510:16:510:21 | call to malloc | destination buffer |
51-
| tests.cpp:520:3:520:8 | call to memset | This 'memset' operation accesses 20 bytes but the $@ is only 10 bytes. | tests.cpp:503:15:503:20 | call to malloc | destination buffer |
5251
| tests.cpp:541:6:541:10 | call to fread | This 'fread' operation may access 101 bytes but the $@ is only 100 bytes. | tests.cpp:532:7:532:16 | charBuffer | destination buffer |
5352
| tests.cpp:546:6:546:10 | call to fread | This 'fread' operation may access 400 bytes but the $@ is only 100 bytes. | tests.cpp:532:7:532:16 | charBuffer | destination buffer |
5453
| tests.cpp:569:6:569:15 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:565:7:565:12 | buffer | array |
@@ -57,9 +56,6 @@
5756
| tests.cpp:586:6:586:12 | access to array | This array indexing operation accesses a negative index -1 on the $@. | tests.cpp:565:7:565:12 | buffer | array |
5857
| tests_restrict.c:12:2:12:7 | call to memcpy | This 'memcpy' operation accesses 2 bytes but the $@ is only 1 byte. | tests_restrict.c:7:6:7:13 | smallbuf | source buffer |
5958
| unions.cpp:26:2:26:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:21:10:21:11 | mu | destination buffer |
60-
| unions.cpp:27:2:27:7 | call to memset | This 'memset' operation accesses 100 bytes but the $@ is only 10 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |
61-
| unions.cpp:29:2:29:7 | call to memset | This 'memset' operation accesses 100 bytes but the $@ is only 10 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |
62-
| unions.cpp:30:2:30:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 10 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |
6359
| unions.cpp:30:2:30:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:15:7:15:11 | small | destination buffer |
6460
| unions.cpp:34:2:34:7 | call to memset | This 'memset' operation accesses 200 bytes but the $@ is only 100 bytes. | unions.cpp:16:7:16:11 | large | destination buffer |
6561
| var_size_struct.cpp:71:3:71:8 | call to memset | This 'memset' operation accesses 1025 bytes but the $@ is only 1024 bytes. | var_size_struct.cpp:67:35:67:40 | call to malloc | destination buffer |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -517,7 +517,7 @@ void test19(bool b)
517517
if (b)
518518
{
519519
memset(p1, 0, 20); // BAD
520-
memset(p2, 0, 20); // GOOD [FALSE POSITIVE]
520+
memset(p2, 0, 20); // GOOD
521521
memset(p3, 0, 20); // GOOD
522522
}
523523
}

0 commit comments

Comments
 (0)