1010 * external/cwe/cwe-295
1111 */
1212
13-
1413import cpp
1514import semmle.code.cpp.controlflow.Guards
1615import semmle.code.cpp.dataflow.DataFlow
1716
1817class SSLGetVerifyResultCall extends FunctionCall {
19- SSLGetVerifyResultCall ( ) {
20- getTarget ( ) .getName ( ) = "SSL_get_verify_result"
21- }
18+ SSLGetVerifyResultCall ( ) { getTarget ( ) .getName ( ) = "SSL_get_verify_result" }
2219}
2320
2421class VerifyResultConfig extends DataFlow:: Configuration {
@@ -29,21 +26,18 @@ class VerifyResultConfig extends DataFlow::Configuration {
2926 }
3027
3128 override predicate isSink ( DataFlow:: Node sink ) {
32- exists ( GuardCondition guard |
33- guard .getAChild * ( ) = sink .asExpr ( )
34- )
29+ exists ( GuardCondition guard | guard .getAChild * ( ) = sink .asExpr ( ) )
3530 }
3631}
3732
3833from
39- VerifyResultConfig config , DataFlow:: Node source , DataFlow:: Node sink1 , DataFlow:: Node sink2 ,
40- GuardCondition guard , Expr c1 , Expr c2 , boolean testIsTrue
34+ VerifyResultConfig config , DataFlow:: Node source , DataFlow:: Node sink1 , DataFlow:: Node sink2 ,
35+ GuardCondition guard , Expr c1 , Expr c2 , boolean testIsTrue
4136where
42- config .hasFlow ( source , sink1 ) and
43- config .hasFlow ( source , sink2 ) and
44- guard .comparesEq ( sink1 .asExpr ( ) , c1 , 0 , false , testIsTrue ) and // (value != c1) => testIsTrue
45- guard .comparesEq ( sink2 .asExpr ( ) , c2 , 0 , false , testIsTrue ) and // (value != c2) => testIsTrue
46- c1 .getValue ( ) .toInt ( ) = 0 and
47- c2 .getValue ( ) .toInt ( ) != 0
48- select
49- guard , "This expression conflates OK and non-OK results from $@." , source , source .toString ( )
37+ config .hasFlow ( source , sink1 ) and
38+ config .hasFlow ( source , sink2 ) and
39+ guard .comparesEq ( sink1 .asExpr ( ) , c1 , 0 , false , testIsTrue ) and // (value != c1) => testIsTrue
40+ guard .comparesEq ( sink2 .asExpr ( ) , c2 , 0 , false , testIsTrue ) and // (value != c2) => testIsTrue
41+ c1 .getValue ( ) .toInt ( ) = 0 and
42+ c2 .getValue ( ) .toInt ( ) != 0
43+ select guard , "This expression conflates OK and non-OK results from $@." , source , source .toString ( )
0 commit comments