Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fae55d5

Browse files
zlaski-semmlezlaski-semmle
committed
[CPP-370] First attempt at isAdditionalFlowStep().
1 parent 012140f commit fae55d5

3 files changed

Lines changed: 22 additions & 22 deletions

File tree

‎cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -45,8 +45,7 @@ predicate whitelistFunction(Function f, int arg) {
4545
predicate underscoreMacro(Expr e) {
4646
exists(MacroInvocation mi |
4747
mi.getMacroName() = "_" and
48-
mi.getExpr() = e and
49-
isConstMacro(e)
48+
mi.getExpr() = e
5049
)
5150
}
5251

@@ -56,21 +55,16 @@ predicate whitelisted(Expr e) {
5655
isConst(fc.getArgument(arg))
5756
)
5857
or
58+
// we let the '_' macro through regardless of what it points at
5959
underscoreMacro(e)
6060
}
6161

62-
predicate isConstMacro(Expr e) {
62+
predicate isConst(Expr e) {
6363
e instanceof StringLiteral
6464
or
6565
whitelisted(e)
6666
}
6767

68-
predicate isConst(Expr e) {
69-
isConstMacro(e)
70-
or
71-
underscoreMacro(e)
72-
}
73-
7468
class ConstFlow extends DataFlow::Configuration {
7569
ConstFlow() { this = "ConstFlow" }
7670

@@ -79,6 +73,20 @@ class ConstFlow extends DataFlow::Configuration {
7973
override predicate isSink(DataFlow::Node sink) {
8074
exists(FormattingFunctionCall fc | sink.asExpr() = fc.getArgument(fc.getFormatParameterIndex()))
8175
}
76+
77+
override predicate isAdditionalFlowStep(DataFlow::Node source, DataFlow::Node sink) {
78+
none()
79+
or
80+
// an element picked from an array of string literals is a string literal
81+
exists(Variable v, int a |
82+
a = sink.asExpr().(ArrayExpr).getArrayOffset().getValue().toInt() and
83+
v = sink.asExpr().(ArrayExpr).getArrayBase().(VariableAccess).getTarget()
84+
|
85+
// we disallow parameters, since they may be bound to unsafe arguments
86+
// at various call sites.
87+
not v instanceof Parameter and source.asExpr() instanceof StringLiteral
88+
)
89+
}
8290
}
8391

8492
from FormattingFunctionCall call, Expr formatString

‎cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/NonConstantFormat.expected‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
| NonConstantFormat.c:50:2:50:7 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
44
| test.cpp:48:3:48:8 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
55
| test.cpp:54:5:54:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
6-
| test.cpp:55:5:55:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
76
| test.cpp:56:5:56:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
87
| test.cpp:57:5:57:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
98
| test.cpp:58:5:58:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
@@ -17,7 +16,4 @@
1716
| test.cpp:79:5:79:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1817
| test.cpp:85:5:85:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
1918
| test.cpp:90:5:90:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
20-
| test.cpp:97:5:97:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
21-
| test.cpp:104:5:104:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
2219
| test.cpp:107:5:107:10 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |
23-
| test.cpp:121:3:121:8 | call to printf | The format string argument to printf should be constant to prevent security issues and other potential errors. |

‎cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ int main(int argc, char **argv) {
5252
char hello[] = "hello, World\n";
5353
hello[0] = 'H';
5454
printf(hello); // NOT OK
55-
printf(_(hello)); // NOT OK
55+
printf(_(hello)); // OK
5656
printf(gettext(hello)); // NOT OK
5757
printf(const_wash(hello)); // NOT OK
5858
printf((hello + 1) + 1); // NOT OK
@@ -94,29 +94,25 @@ int main(int argc, char **argv) {
9494
const char *hello = "Hello, World\n";
9595
const char **p = &hello;
9696
(*p)++;
97-
printf(hello); // NOT OK
97+
printf(hello); // NOT OK [NOT DETECTED]
9898
}
9999
{
100100
// Same as above block but through a C++ reference
101101
const char *hello = "Hello, World\n";
102102
const char *&p = hello;
103103
p++;
104-
printf(hello); // NOT OK
104+
printf(hello); // NOT OK [NOT DETECTED]
105105
}
106106
if (gettext_debug) {
107107
printf(new char[100]); // NOT OK
108108
}
109109
{
110110
const char *hello = "Hello, World\n";
111111
const char *const *p = &hello; // harmless reference to const pointer
112-
printf(hello); // OK [FALSE POSITIVE]
112+
printf(hello); // OK
113113
hello++; // modification comes after use and so does no harm
114114
}
115115
printf(argc > 2 ? "More than one\n" : _("Only one\n")); // OK
116116

117-
// This false positive arises because we use const_wash in a problematic
118-
// place at one call site, and then the error spreads to all call sites. It
119-
// does not happen for "_" only because functions with the name "_" are
120-
// special-cased and assumed correct in the query.
121-
printf(const_wash("Hello, World\n")); // OK [FALSE POSITIVE]
117+
printf(const_wash("Hello, World\n")); // OK
122118
}

0 commit comments

Comments
 (0)