Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 973aad5

Browse files
MathiasVPMathiasVP
authored
Merge pull request #11677 from jketema/argv-flow-source
C++: Recognize indirect `argv` accesses as flow sources for use-use dataflow
2 parents 628f92a + 3be0b3e commit 973aad5

6 files changed

Lines changed: 68 additions & 1 deletion

File tree

‎cpp/ql/lib/semmle/code/cpp/security/FlowSources.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ private class ArgvSource extends LocalFlowSource {
5353
exists(Function main, Parameter argv |
5454
main.hasGlobalName("main") and
5555
main.getParameter(1) = argv and
56-
this.asExpr() = argv.getAnAccess()
56+
argv.getAnAccess() in [this.asExpr(), this.asIndirectExpr()]
5757
)
5858
}
5959

‎cpp/ql/test/query-tests/Security/CWE/CWE-078/semmle/ExecTainted/ExecTainted.expected‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
11
edges
2+
| test.cpp:16:20:16:23 | argv indirection | test.cpp:22:45:22:52 | Load indirection |
3+
| test.cpp:16:20:16:23 | argv indirection | test.cpp:22:45:22:52 | Load indirection |
4+
| test.cpp:22:13:22:20 | sprintf output argument | test.cpp:23:12:23:19 | Convert indirection |
5+
| test.cpp:22:45:22:52 | Load indirection | test.cpp:22:13:22:20 | sprintf output argument |
26
| test.cpp:47:21:47:26 | call to getenv indirection | test.cpp:50:35:50:43 | Load indirection |
37
| test.cpp:50:11:50:17 | sprintf output argument | test.cpp:51:10:51:16 | Convert indirection |
48
| test.cpp:50:35:50:43 | Load indirection | test.cpp:50:11:50:17 | sprintf output argument |
@@ -97,6 +101,11 @@ edges
97101
| test.cpp:220:19:220:26 | Convert indirection | test.cpp:220:10:220:16 | strncat output argument |
98102
| test.cpp:220:19:220:26 | Convert indirection | test.cpp:220:10:220:16 | strncat output argument |
99103
nodes
104+
| test.cpp:16:20:16:23 | argv indirection | semmle.label | argv indirection |
105+
| test.cpp:16:20:16:23 | argv indirection | semmle.label | argv indirection |
106+
| test.cpp:22:13:22:20 | sprintf output argument | semmle.label | sprintf output argument |
107+
| test.cpp:22:45:22:52 | Load indirection | semmle.label | Load indirection |
108+
| test.cpp:23:12:23:19 | Convert indirection | semmle.label | Convert indirection |
100109
| test.cpp:47:21:47:26 | call to getenv indirection | semmle.label | call to getenv indirection |
101110
| test.cpp:50:11:50:17 | sprintf output argument | semmle.label | sprintf output argument |
102111
| test.cpp:50:35:50:43 | Load indirection | semmle.label | Load indirection |
@@ -202,6 +211,8 @@ subpaths
202211
| test.cpp:196:26:196:33 | filename | test.cpp:186:47:186:54 | filename | test.cpp:187:11:187:15 | strncat output argument | test.cpp:196:19:196:23 | concat output argument |
203212
| test.cpp:196:26:196:33 | filename | test.cpp:186:47:186:54 | filename | test.cpp:188:11:188:17 | strncat output argument | test.cpp:196:10:196:16 | concat output argument |
204213
#select
214+
| test.cpp:23:12:23:19 | command1 | test.cpp:16:20:16:23 | argv indirection | test.cpp:23:12:23:19 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:16:20:16:23 | argv indirection | user input (a command-line argument) | test.cpp:22:13:22:20 | sprintf output argument | sprintf output argument |
215+
| test.cpp:23:12:23:19 | command1 | test.cpp:16:20:16:23 | argv indirection | test.cpp:23:12:23:19 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:16:20:16:23 | argv indirection | user input (a command-line argument) | test.cpp:22:13:22:20 | sprintf output argument | sprintf output argument |
205216
| test.cpp:51:10:51:16 | command | test.cpp:47:21:47:26 | call to getenv indirection | test.cpp:51:10:51:16 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:47:21:47:26 | call to getenv indirection | user input (an environment variable) | test.cpp:50:11:50:17 | sprintf output argument | sprintf output argument |
206217
| test.cpp:65:10:65:16 | command | test.cpp:62:9:62:16 | fread output argument | test.cpp:65:10:65:16 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to system(string). | test.cpp:62:9:62:16 | fread output argument | user input (string read by fread) | test.cpp:64:11:64:17 | strncat output argument | strncat output argument |
207218
| test.cpp:85:32:85:38 | command | test.cpp:82:9:82:16 | fread output argument | test.cpp:85:32:85:38 | Convert indirection | This argument to an OS command is derived from $@, dangerously concatenated into $@, and then passed to execl. | test.cpp:82:9:82:16 | fread output argument | user input (string read by fread) | test.cpp:84:11:84:17 | strncat output argument | strncat output argument |

‎cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
edges
22
| overflowdestination.cpp:27:9:27:12 | argv | overflowdestination.cpp:30:17:30:20 | arg1 |
3+
| overflowdestination.cpp:27:9:27:12 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 |
4+
| overflowdestination.cpp:27:9:27:12 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 |
35
| overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | src |
46
| overflowdestination.cpp:50:52:50:54 | src | overflowdestination.cpp:52:9:52:12 | memcpy output argument |
57
| overflowdestination.cpp:50:52:50:54 | src | overflowdestination.cpp:53:9:53:12 | memcpy output argument |
@@ -60,6 +62,8 @@ edges
6062
| overflowdestination.cpp:76:30:76:32 | src | overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument |
6163
nodes
6264
| overflowdestination.cpp:27:9:27:12 | argv | semmle.label | argv |
65+
| overflowdestination.cpp:27:9:27:12 | argv indirection | semmle.label | argv indirection |
66+
| overflowdestination.cpp:27:9:27:12 | argv indirection | semmle.label | argv indirection |
6367
| overflowdestination.cpp:30:17:30:20 | arg1 | semmle.label | arg1 |
6468
| overflowdestination.cpp:43:8:43:10 | fgets output argument | semmle.label | fgets output argument |
6569
| overflowdestination.cpp:46:15:46:17 | src | semmle.label | src |
@@ -118,6 +122,8 @@ subpaths
118122
| overflowdestination.cpp:76:30:76:32 | src | overflowdestination.cpp:57:52:57:54 | src | overflowdestination.cpp:65:9:65:13 | memcpy output argument | overflowdestination.cpp:76:30:76:32 | overflowdest_test3 output argument |
119123
#select
120124
| overflowdestination.cpp:30:2:30:8 | call to strncpy | overflowdestination.cpp:27:9:27:12 | argv | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
125+
| overflowdestination.cpp:30:2:30:8 | call to strncpy | overflowdestination.cpp:27:9:27:12 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
126+
| overflowdestination.cpp:30:2:30:8 | call to strncpy | overflowdestination.cpp:27:9:27:12 | argv indirection | overflowdestination.cpp:30:17:30:20 | arg1 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
121127
| overflowdestination.cpp:46:2:46:7 | call to memcpy | overflowdestination.cpp:43:8:43:10 | fgets output argument | overflowdestination.cpp:46:15:46:17 | src | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
122128
| overflowdestination.cpp:53:2:53:7 | call to memcpy | overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:53:15:53:17 | src | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
123129
| overflowdestination.cpp:64:2:64:7 | call to memcpy | overflowdestination.cpp:73:8:73:10 | fgets output argument | overflowdestination.cpp:64:16:64:19 | src2 | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |

‎cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.expected‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ edges
33
| test1.c:8:16:8:19 | argv | test1.c:11:9:11:9 | i |
44
| test1.c:8:16:8:19 | argv | test1.c:12:9:12:9 | i |
55
| test1.c:8:16:8:19 | argv | test1.c:13:9:13:9 | i |
6+
| test1.c:8:16:8:19 | argv indirection | test1.c:9:9:9:9 | i |
7+
| test1.c:8:16:8:19 | argv indirection | test1.c:9:9:9:9 | i |
8+
| test1.c:8:16:8:19 | argv indirection | test1.c:11:9:11:9 | i |
9+
| test1.c:8:16:8:19 | argv indirection | test1.c:11:9:11:9 | i |
10+
| test1.c:8:16:8:19 | argv indirection | test1.c:12:9:12:9 | i |
11+
| test1.c:8:16:8:19 | argv indirection | test1.c:12:9:12:9 | i |
12+
| test1.c:8:16:8:19 | argv indirection | test1.c:13:9:13:9 | i |
13+
| test1.c:8:16:8:19 | argv indirection | test1.c:13:9:13:9 | i |
614
| test1.c:9:9:9:9 | i | test1.c:16:16:16:16 | i |
715
| test1.c:11:9:11:9 | i | test1.c:32:16:32:16 | i |
816
| test1.c:12:9:12:9 | i | test1.c:40:16:40:16 | i |
@@ -13,6 +21,8 @@ edges
1321
| test1.c:48:16:48:16 | i | test1.c:53:15:53:15 | j |
1422
nodes
1523
| test1.c:8:16:8:19 | argv | semmle.label | argv |
24+
| test1.c:8:16:8:19 | argv indirection | semmle.label | argv indirection |
25+
| test1.c:8:16:8:19 | argv indirection | semmle.label | argv indirection |
1626
| test1.c:9:9:9:9 | i | semmle.label | i |
1727
| test1.c:11:9:11:9 | i | semmle.label | i |
1828
| test1.c:12:9:12:9 | i | semmle.label | i |
@@ -28,6 +38,14 @@ nodes
2838
subpaths
2939
#select
3040
| test1.c:18:16:18:16 | i | test1.c:8:16:8:19 | argv | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv | a command-line argument |
41+
| test1.c:18:16:18:16 | i | test1.c:8:16:8:19 | argv indirection | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
42+
| test1.c:18:16:18:16 | i | test1.c:8:16:8:19 | argv indirection | test1.c:18:16:18:16 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
3143
| test1.c:33:11:33:11 | i | test1.c:8:16:8:19 | argv | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv | a command-line argument |
44+
| test1.c:33:11:33:11 | i | test1.c:8:16:8:19 | argv indirection | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
45+
| test1.c:33:11:33:11 | i | test1.c:8:16:8:19 | argv indirection | test1.c:33:11:33:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
3246
| test1.c:41:11:41:11 | i | test1.c:8:16:8:19 | argv | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv | a command-line argument |
47+
| test1.c:41:11:41:11 | i | test1.c:8:16:8:19 | argv indirection | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
48+
| test1.c:41:11:41:11 | i | test1.c:8:16:8:19 | argv indirection | test1.c:41:11:41:11 | i | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
3349
| test1.c:53:15:53:15 | j | test1.c:8:16:8:19 | argv | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv | a command-line argument |
50+
| test1.c:53:15:53:15 | j | test1.c:8:16:8:19 | argv indirection | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |
51+
| test1.c:53:15:53:15 | j | test1.c:8:16:8:19 | argv indirection | test1.c:53:15:53:15 | j | An array indexing expression depends on $@ that might be outside the bounds of the array. | test1.c:8:16:8:19 | argv indirection | a command-line argument |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,18 @@ edges
55
| test.cpp:40:21:40:24 | argv | test.cpp:49:32:49:35 | size |
66
| test.cpp:40:21:40:24 | argv | test.cpp:50:26:50:29 | size |
77
| test.cpp:40:21:40:24 | argv | test.cpp:53:35:53:60 | ... * ... |
8+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:43:38:43:44 | tainted |
9+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:43:38:43:44 | tainted |
10+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:44:38:44:63 | ... * ... |
11+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:44:38:44:63 | ... * ... |
12+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:46:38:46:63 | ... + ... |
13+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:46:38:46:63 | ... + ... |
14+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:49:32:49:35 | size |
15+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:49:32:49:35 | size |
16+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:50:26:50:29 | size |
17+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:50:26:50:29 | size |
18+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:53:35:53:60 | ... * ... |
19+
| test.cpp:40:21:40:24 | argv indirection | test.cpp:53:35:53:60 | ... * ... |
820
| test.cpp:124:18:124:23 | call to getenv | test.cpp:128:24:128:41 | ... * ... |
921
| test.cpp:124:18:124:31 | call to getenv indirection | test.cpp:128:24:128:41 | ... * ... |
1022
| test.cpp:133:19:133:24 | call to getenv | test.cpp:135:10:135:27 | ... * ... |
@@ -36,6 +48,8 @@ edges
3648
| test.cpp:338:19:338:32 | call to getenv indirection | test.cpp:342:25:342:43 | ... * ... |
3749
nodes
3850
| test.cpp:40:21:40:24 | argv | semmle.label | argv |
51+
| test.cpp:40:21:40:24 | argv indirection | semmle.label | argv indirection |
52+
| test.cpp:40:21:40:24 | argv indirection | semmle.label | argv indirection |
3953
| test.cpp:43:38:43:44 | tainted | semmle.label | tainted |
4054
| test.cpp:44:38:44:63 | ... * ... | semmle.label | ... * ... |
4155
| test.cpp:46:38:46:63 | ... + ... | semmle.label | ... + ... |
@@ -80,11 +94,23 @@ nodes
8094
subpaths
8195
#select
8296
| test.cpp:43:31:43:36 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
97+
| test.cpp:43:31:43:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
98+
| test.cpp:43:31:43:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:43:38:43:44 | tainted | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
8399
| test.cpp:44:31:44:36 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
100+
| test.cpp:44:31:44:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
101+
| test.cpp:44:31:44:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:44:38:44:63 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
84102
| test.cpp:46:31:46:36 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
103+
| test.cpp:46:31:46:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
104+
| test.cpp:46:31:46:36 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:46:38:46:63 | ... + ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
85105
| test.cpp:49:25:49:30 | call to malloc | test.cpp:40:21:40:24 | argv | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
106+
| test.cpp:49:25:49:30 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
107+
| test.cpp:49:25:49:30 | call to malloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:49:32:49:35 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
86108
| test.cpp:50:17:50:30 | new[] | test.cpp:40:21:40:24 | argv | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
109+
| test.cpp:50:17:50:30 | new[] | test.cpp:40:21:40:24 | argv indirection | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
110+
| test.cpp:50:17:50:30 | new[] | test.cpp:40:21:40:24 | argv indirection | test.cpp:50:26:50:29 | size | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
87111
| test.cpp:53:21:53:27 | call to realloc | test.cpp:40:21:40:24 | argv | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv | user input (a command-line argument) |
112+
| test.cpp:53:21:53:27 | call to realloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
113+
| test.cpp:53:21:53:27 | call to realloc | test.cpp:40:21:40:24 | argv indirection | test.cpp:53:35:53:60 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:40:21:40:24 | argv indirection | user input (a command-line argument) |
88114
| test.cpp:128:17:128:22 | call to malloc | test.cpp:124:18:124:23 | call to getenv | test.cpp:128:24:128:41 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:124:18:124:23 | call to getenv | user input (an environment variable) |
89115
| test.cpp:128:17:128:22 | call to malloc | test.cpp:124:18:124:31 | call to getenv indirection | test.cpp:128:24:128:41 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:124:18:124:31 | call to getenv indirection | user input (an environment variable) |
90116
| test.cpp:135:3:135:8 | call to malloc | test.cpp:133:19:133:24 | call to getenv | test.cpp:135:10:135:27 | ... * ... | This allocation size is derived from $@ and might overflow. | test.cpp:133:19:133:24 | call to getenv | user input (an environment variable) |

0 commit comments

Comments
 (0)