CPP: Move the 'gets' case.

geoffw0 · geoffw0 · commit 429f53ed74d0 · 2019-02-05T17:58:30.000Z
diff --git a/cpp/ql/src/Likely Bugs/Memory Management/PotentialBufferOverflow.ql b/cpp/ql/src/Likely Bugs/Memory Management/PotentialBufferOverflow.ql
@@ -18,20 +18,6 @@ abstract class PotentiallyDangerousFunctionCall extends FunctionCall {
   abstract string getDescription();
 }
 
-class GetsCall extends PotentiallyDangerousFunctionCall {
-  GetsCall() {
-    this.getTarget().hasName("gets")
-  }
-
-  override predicate isDangerous() {
-    any()
-  }
-
-  override string getDescription() {
-    result = "gets does not guard against buffer overflow"
-  }
-}
-
 class SprintfCall extends PotentiallyDangerousFunctionCall {
   SprintfCall() {
     this.getTarget().hasName("sprintf") or this.getTarget().hasName("vsprintf")
diff --git a/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql b/cpp/ql/src/Security/CWE/CWE-676/PotentiallyDangerousFunction.ql
@@ -15,6 +15,9 @@ predicate potentiallyDangerousFunction(Function f, string message) {
   (
     f.getQualifiedName() = "gmtime" and
     message = "Call to gmtime is potentially dangerous"
+  ) or (
+    f.hasName("gets") and
+    message = "gets does not guard against buffer overflow"
   )
 }
 
diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/PotentiallyDangerousFunction.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-676/semmle/PotentiallyDangerousFunction/PotentiallyDangerousFunction.expected
@@ -1 +1,3 @@
 | test.c:28:22:28:27 | call to gmtime | Call to gmtime is potentially dangerous |
+| test.c:39:2:39:5 | call to gets | gets does not guard against buffer overflow |
+| test.c:40:6:40:9 | call to gets | gets does not guard against buffer overflow |

Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,9 @@ predicate potentiallyDangerousFunction(Function f, string message) {`
`15`	`15`	`(`
`16`	`16`	`f.getQualifiedName() = "gmtime" and`
`17`	`17`	`message = "Call to gmtime is potentially dangerous"`
	`18`	`+ ) or (`
	`19`	`+ f.hasName("gets") and`
	`20`	`+ message = "gets does not guard against buffer overflow"`
`18`	`21`	`)`
`19`	`22`	`}`
`20`	`23`
Original file line number	Diff line number	Diff line change
`@@ -1 +1,3 @@`
`1`	`1`	`\| test.c:28:22:28:27 \| call to gmtime \| Call to gmtime is potentially dangerous \|`
	`2`	`+\| test.c:39:2:39:5 \| call to gets \| gets does not guard against buffer overflow \|`
	`3`	`+\| test.c:40:6:40:9 \| call to gets \| gets does not guard against buffer overflow \|`