Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit c40c88e

Browse files
geoffw0geoffw0
committed
CPP: Add test cases for ConditionallyUninitializedVariables.ql.
1 parent d693eb8 commit c40c88e

4 files changed

Lines changed: 143 additions & 0 deletions

File tree

‎cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.expected‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
| examples.cpp:38:3:38:18 | call to initDeviceConfig | The status of this call to $@ is not checked, potentially leaving $@ uninitialized. | examples.cpp:13:5:13:20 | initDeviceConfig | initDeviceConfig | examples.cpp:37:16:37:21 | config | config |
2+
| test.cpp:22:2:22:17 | call to maybeInitialize1 | The status of this call to $@ is not checked, potentially leaving $@ uninitialized. | test.cpp:4:5:4:20 | maybeInitialize1 | maybeInitialize1 | test.cpp:19:6:19:6 | a | a |
3+
| test.cpp:68:2:68:17 | call to maybeInitialize2 | The status of this call to $@ is not checked, potentially leaving $@ uninitialized. | test.cpp:51:6:51:21 | maybeInitialize2 | maybeInitialize2 | test.cpp:66:6:66:6 | a | a |

‎cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/ConditionallyUninitializedVariable.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Security/CWE/CWE-457/ConditionallyUninitializedVariable.ql

‎cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/examples.cpp‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// based on the qhelp
2+
3+
int getMaxDevices();
4+
bool fetchIsDeviceEnabled(int deviceNumber);
5+
int fetchDeviceChannel(int deviceNumber);
6+
void notifyChannel(int channel);
7+
8+
struct DeviceConfig {
9+
bool isEnabled;
10+
int channel;
11+
};
12+
13+
int initDeviceConfig(DeviceConfig *ref, int deviceNumber) {
14+
if (deviceNumber >= getMaxDevices()) {
15+
// No device with that number, return -1 to indicate failure
16+
return -1;
17+
}
18+
// Device with that number, fetch parameters and initialize struct
19+
ref->isEnabled = fetchIsDeviceEnabled(deviceNumber);
20+
ref->channel = fetchDeviceChannel(deviceNumber);
21+
// Return 0 to indicate success
22+
return 0;
23+
}
24+
25+
void notifyGood(int deviceNumber) {
26+
DeviceConfig config;
27+
int statusCode = initDeviceConfig(&config, deviceNumber);
28+
if (statusCode == 0) {
29+
// GOOD: Status code returned by initialization function is checked, so this is safe
30+
if (config.isEnabled) {
31+
notifyChannel(config.channel);
32+
}
33+
}
34+
}
35+
36+
int notifyBad(int deviceNumber) {
37+
DeviceConfig config;
38+
initDeviceConfig(&config, deviceNumber);
39+
// BAD: Using config without checking the status code that is returned
40+
if (config.isEnabled) {
41+
notifyChannel(config.channel);
42+
}
43+
}

‎cpp/ql/test/query-tests/Security/CWE/CWE-457/semmle/ConditionallyUninitializedVariable/test.cpp‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
2+
void use(int i);
3+
4+
int maybeInitialize1(int *v)
5+
{
6+
static int resources = 100;
7+
8+
if (resources == 0)
9+
{
10+
return 0; // FAIL
11+
}
12+
13+
*v = resources--;
14+
return 1; // SUCCESS
15+
}
16+
17+
void test1()
18+
{
19+
int a, b, c, d, e, f;
20+
int result1, result2;
21+
22+
maybeInitialize1(&a); // BAD (initialization not checked)
23+
use(a);
24+
25+
if (maybeInitialize1(&b) == 1) // GOOD
26+
{
27+
use(b);
28+
}
29+
30+
if (maybeInitialize1(&c) == 0) // BAD (initialization check is wrong) [NOT DETECTED]
31+
{
32+
use(c);
33+
}
34+
35+
result1 = maybeInitialize1(&d); // BAD (initialization stored but not checked) [NOT DETECTED]
36+
use(d);
37+
38+
result2 = maybeInitialize1(&e); // GOOD
39+
if (result2 == 1)
40+
{
41+
use(e);
42+
}
43+
44+
if (maybeInitialize1(&f) == 0) // GOOD
45+
{
46+
return;
47+
}
48+
use(f);
49+
}
50+
51+
bool maybeInitialize2(int *v)
52+
{
53+
static int resources = 100;
54+
55+
if (resources > 0)
56+
{
57+
*v = resources--;
58+
return true; // SUCCESS
59+
}
60+
61+
return false; // FAIL
62+
}
63+
64+
void test2()
65+
{
66+
int a, b;
67+
68+
maybeInitialize2(&a); // BAD (initialization not checked)
69+
use(a);
70+
71+
if (maybeInitialize2(&b)) // GOOD
72+
{
73+
use(b);
74+
}
75+
}
76+
77+
int alwaysInitialize(int *v)
78+
{
79+
static int resources = 0;
80+
81+
*v = resources++;
82+
return 1; // SUCCESS
83+
}
84+
85+
void test3()
86+
{
87+
int a, b;
88+
89+
alwaysInitialize(&a); // GOOD (initialization never fails)
90+
use(a);
91+
92+
if (alwaysInitialize(&b) == 1) // GOOD
93+
{
94+
use(b);
95+
}
96+
}

0 commit comments

Comments
 (0)