CPP: Fix in dataflow.

geoffw0 · geoffw0 · commit 3deff9c57838 · 2019-06-10T12:01:14.000+01:00
diff --git a/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll b/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll
@@ -75,7 +75,11 @@ predicate moveToDependingOnSide(Expr src, Expr dest) {
     and (base = binop.getLeftOperand() or base = binop.getRightOperand())
     and isPointer(base.getType())
     and base.getTarget() instanceof LocalScopeVariable
-    and src = base)
+    and src = base
+
+    // flow through pointer-pointer subtraction is dubious, the result should be
+    // a number bounded by the size of the pointed-to thing.
+    and not binop instanceof PointerDiffExpr)
   or exists (UnaryOperation unop |
     dest = unop
     and unop.getAnOperand() = src)
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected
@@ -4,4 +4,3 @@
 | test.cpp:49:17:49:30 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
 | test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
 | test.cpp:55:11:55:24 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) |
-| test.cpp:79:9:79:29 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:97:18:97:23 | buffer | user input (fread) |
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/test.cpp
@@ -76,7 +76,7 @@ void processData2(char *start, char *end)
 {
 	char *copy;
 
-	copy = new char[end - start]; // GOOD [FALSE POSITIVE]
+	copy = new char[end - start]; // GOOD
 
 	// ...
 

Original file line number	Diff line number	Diff line change
`@@ -76,7 +76,7 @@ void processData2(char start, char end)`
`76`	`76`	`{`
`77`	`77`	`char *copy;`
`78`	`78`
`79`		`- copy = new char[end - start]; // GOOD [FALSE POSITIVE]`
	`79`	`+ copy = new char[end - start]; // GOOD`
`80`	`80`
`81`	`81`	`// ...`
`82`	`82`