Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 693baae

Browse files
MathiasVPMathiasVP
committed
C++: Add test cases with false positives due to missing range analysis in 'cpp/overrunning-write'.
1 parent e9b1146 commit 693baae

2 files changed

Lines changed: 42 additions & 0 deletions

File tree

‎cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/OverrunWrite.expected‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,15 @@
33
| tests.cpp:272:2:272:8 | call to sprintf | This 'call to sprintf' operation requires 9 bytes but the destination is only 8 bytes. |
44
| tests.cpp:273:2:273:8 | call to sprintf | This 'call to sprintf' operation requires 9 bytes but the destination is only 8 bytes. |
55
| tests.cpp:308:3:308:9 | call to sprintf | This 'call to sprintf' operation requires 9 bytes but the destination is only 8 bytes. |
6+
| tests.cpp:315:2:315:8 | call to sprintf | This 'call to sprintf' operation requires 11 bytes but the destination is only 2 bytes. |
7+
| tests.cpp:316:2:316:8 | call to sprintf | This 'call to sprintf' operation requires 12 bytes but the destination is only 2 bytes. |
8+
| tests.cpp:318:3:318:9 | call to sprintf | This 'call to sprintf' operation requires 11 bytes but the destination is only 2 bytes. |
9+
| tests.cpp:321:2:321:8 | call to sprintf | This 'call to sprintf' operation requires 11 bytes but the destination is only 2 bytes. |
10+
| tests.cpp:324:3:324:9 | call to sprintf | This 'call to sprintf' operation requires 11 bytes but the destination is only 2 bytes. |
11+
| tests.cpp:327:2:327:8 | call to sprintf | This 'call to sprintf' operation requires 12 bytes but the destination is only 2 bytes. |
12+
| tests.cpp:329:3:329:9 | call to sprintf | This 'call to sprintf' operation requires 12 bytes but the destination is only 2 bytes. |
13+
| tests.cpp:332:4:332:10 | call to sprintf | This 'call to sprintf' operation requires 12 bytes but the destination is only 2 bytes. |
14+
| tests.cpp:336:2:336:8 | call to sprintf | This 'call to sprintf' operation requires 11 bytes but the destination is only 2 bytes. |
15+
| tests.cpp:337:2:337:8 | call to sprintf | This 'call to sprintf' operation requires 12 bytes but the destination is only 2 bytes. |
16+
| tests.cpp:338:2:338:8 | call to sprintf | This 'call to sprintf' operation requires 11 bytes but the destination is only 2 bytes. |
17+
| tests.cpp:339:2:339:8 | call to sprintf | This 'call to sprintf' operation requires 12 bytes but the destination is only 2 bytes. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-242/semmle/tests/tests.cpp‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -307,4 +307,34 @@ namespace custom_sprintf_impl {
307307
char buffer8[8];
308308
sprintf(buffer8, "12345678"); // BAD: potential buffer overflow
309309
}
310+
}
311+
312+
void test6(unsigned unsigned_value, int value) {
313+
char buffer[2];
314+
315+
sprintf(buffer, "%u", unsigned_value); // BAD: buffer overflow
316+
sprintf(buffer, "%d", unsigned_value); // BAD: buffer overflow
317+
if (unsigned_value < 10) {
318+
sprintf(buffer, "%u", unsigned_value); // GOOD [FALSE POSITIVE]
319+
}
320+
321+
sprintf(buffer, "%u", -10); // BAD: buffer overflow
322+
323+
if(unsigned_value == (unsigned)-10) {
324+
sprintf(buffer, "%u", unsigned_value); // BAD: buffer overflow
325+
}
326+
327+
sprintf(buffer, "%d", value); // BAD: buffer overflow
328+
if (value < 10) {
329+
sprintf(buffer, "%d", value); // BAD: buffer overflow
330+
331+
if(value > 0) {
332+
sprintf(buffer, "%d", value); // GOOD [FALSE POSITIVE]
333+
}
334+
}
335+
336+
sprintf(buffer, "%u", 0); // GOOD [FALSE POSITIVE]
337+
sprintf(buffer, "%d", 0); // GOOD [FALSE POSITIVE]
338+
sprintf(buffer, "%u", 5); // GOOD [FALSE POSITIVE]
339+
sprintf(buffer, "%d", 5); // GOOD [FALSE POSITIVE]
310340
}

0 commit comments

Comments
 (0)