github
diff --git a/‎cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Brotli.qll‎
Lines changed: 38 additions & 0 deletions b/‎cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Brotli.qll‎
Lines changed: 38 additions & 0 deletions
diff --git a/‎cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bzip2.qll‎
Lines changed: 50 additions & 0 deletions b/‎cpp/ql/src/experimental/Security/CWE/CWE-409-DecompressionBomb/Bzip2.qll‎
Lines changed: 50 additions & 0 deletions
@@ -0,0 +1,38 @@
+/**
+ * https://github.com/google/brotli
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+
+/**
+ * A Pointer Variable is used in Flow source
+ */
+class PointerVar extends VariableAccess {
+  PointerVar() { this.getType() instanceof PointerType }
+}
+
+/**
+ * A Pointer Variable is used in Flow source
+ */
+class Uint8Var extends VariableAccess {
+  Uint8Var() { this.getType() instanceof UInt8_t }
+}
+
+/**
+ * The `BrotliDecoderDecompress` function is used in Flow sink
+ * Ref: https://www.brotli.org/decode.html#af68
+ */
+class BrotliDecoderDecompressFunction extends Function {
+  BrotliDecoderDecompressFunction() { this.hasGlobalName(["BrotliDecoderDecompress"]) }
+}
+
+/**
+ * The `BrotliDecoderDecompressStream` function is used in Flow sink
+ * Ref: https://www.brotli.org/decode.html#a234
+ */
+class BrotliDecoderDecompressStreamFunction extends Function {
+  BrotliDecoderDecompressStreamFunction() { this.hasGlobalName(["BrotliDecoderDecompressStream"]) }
+}
@@ -0,0 +1,50 @@
+/**
+ * https://www.sourceware.org/bzip2/manual/manual.html
+ */
+
+import cpp
+import semmle.code.cpp.ir.dataflow.TaintTracking
+import semmle.code.cpp.security.FlowSources
+import semmle.code.cpp.commons.File
+
+/**
+ * A `bz_stream` Variable as a Flow source
+ */
+class BzStreamVar extends VariableAccess {
+  BzStreamVar() { this.getType().hasName("bz_stream") }
+}
+
+/**
+ * A `BZFILE` Variable as a Flow source
+ */
+class BzFileVar extends VariableAccess {
+  BzFileVar() { this.getType().hasName("BZFILE") }
+}
+
+/**
+ * The `BZ2_bzDecompress` function as a Flow source
+ */
+class BZ2BzDecompressFunction extends Function {
+  BZ2BzDecompressFunction() { this.hasGlobalName(["BZ2_bzDecompress"]) }
+}
+
+/**
+ * The `BZ2_bzReadOpen` function
+ */
+class BZ2BzReadOpenFunction extends Function {
+  BZ2BzReadOpenFunction() { this.hasGlobalName(["BZ2_bzReadOpen"]) }
+}
+
+/**
+ * The `BZ2_bzRead` function is used in Flow sink
+ */
+class BZ2BzReadFunction extends Function {
+  BZ2BzReadFunction() { this.hasGlobalName("BZ2_bzRead") }
+}
+
+/**
+ * The `BZ2_bzBuffToBuffDecompress` function is used in Flow sink
+ */
+class BZ2BzBuffToBuffDecompressFunction extends Function {
+  BZ2BzBuffToBuffDecompressFunction() { this.hasGlobalName("BZ2_bzBuffToBuffDecompress") }
+}