category: minorAnalysis

* Added a new experimental query, `cpp/experimental/mmio-unsanitized-memcpy`, to detect memory copy operations whose size argument is derived from allowlisted MMIO/DMA register-read macros without sufficient bounds validation.

- apply: security-extended-selectors.yml

from: codeql/suite-helpers

- apply: codeql-suites/exclude-slow-queries.yml

<overview>

<p>

Firmware and embedded drivers often copy data into buffers using lengths read from

allowlisted MMIO register macros such as <code>READ_REG</code> or <code>GET_MMIO</code>.

When those lengths are not validated against the destination buffer size, an attacker who

can influence hardware registers or DMA metadata can trigger buffer overflows.

</p>

</overview>

<recommendation>

import semmle.code.cpp.controlflow.IRGuards

import MmioFlow::PathGraph

predicate isMmioSource(DataFlow::Node source) {

exists(MacroInvocation mi |

mi.getMacro().hasName(["READ_REG", "GET_MMIO", "REG_READ", "DMA_READ"]) and

source.asExpr() = mi.getExpr()

#select

| test.c:26:3:26:8 | call to memcpy | test.c:25:18:25:37 | * ... | test.c:26:20:26:22 | len | Memory copy size argument is derived from $@ without sufficient bounds validation. | test.c:25:18:25:37 | * ... | an MMIO/DMA hardware register read |

| test.c:31:3:31:9 | call to memmove | test.c:30:18:30:37 | * ... | test.c:31:21:31:23 | len | Memory copy size argument is derived from $@ without sufficient bounds validation. | test.c:30:18:30:37 | * ... | an MMIO/DMA hardware register read |

| test.c:36:3:36:9 | call to strncpy | test.c:35:18:35:37 | * ... | test.c:36:21:36:23 | len | Memory copy size argument is derived from $@ without sufficient bounds validation. | test.c:35:18:35:37 | * ... | an MMIO/DMA hardware register read |

| test.c:41:3:41:8 | call to memcpy | test.c:40:18:40:37 | * ... | test.c:41:20:41:22 | len | Memory copy size argument is derived from $@ without sufficient bounds validation. | test.c:40:18:40:37 | * ... | an MMIO/DMA hardware register read |

edges

| test.c:25:18:25:37 | * ... | test.c:25:18:25:37 | * ... | provenance | |

| test.c:25:18:25:37 | * ... | test.c:26:20:26:22 | len | provenance | |

| test.c:30:18:30:37 | * ... | test.c:30:18:30:37 | * ... | provenance | |

| test.c:30:18:30:37 | * ... | test.c:31:21:31:23 | len | provenance | |

| test.c:35:18:35:37 | * ... | test.c:35:18:35:37 | * ... | provenance | |

| test.c:35:18:35:37 | * ... | test.c:36:21:36:23 | len | provenance | |

| test.c:40:18:40:37 | * ... | test.c:40:18:40:37 | * ... | provenance | |

| test.c:40:18:40:37 | * ... | test.c:41:20:41:22 | len | provenance | |

nodes

| test.c:25:18:25:37 | * ... | semmle.label | * ... |

| test.c:25:18:25:37 | * ... | semmle.label | * ... |

| test.c:26:20:26:22 | len | semmle.label | len |

| test.c:30:18:30:37 | * ... | semmle.label | * ... |

| test.c:30:18:30:37 | * ... | semmle.label | * ... |

| test.c:31:21:31:23 | len | semmle.label | len |

| test.c:35:18:35:37 | * ... | semmle.label | * ... |

| test.c:35:18:35:37 | * ... | semmle.label | * ... |

| test.c:36:21:36:23 | len | semmle.label | len |

| test.c:40:18:40:37 | * ... | semmle.label | * ... |

| test.c:40:18:40:37 | * ... | semmle.label | * ... |

| test.c:41:20:41:22 | len | semmle.label | len |

subpaths

query: experimental/Security/CWE/CWE-120/MmioUnsanitizedMemcpy.ql

postprocess: utils/test/InlineExpectationsTestQuery.ql

typedef unsigned int uint32_t;

void *memcpy(void *dest, const void *src, unsigned long n);

void *memmove(void *dest, const void *src, unsigned long n);

char *strncpy(char *dest, const char *src, unsigned long n);

#define READ_REG(addr) (*(volatile uint32_t *)(addr))

#define GET_MMIO(addr) (*(volatile uint32_t *)(addr))

#define REG_READ(addr) (*(volatile uint32_t *)(addr))

#define DMA_READ(addr) (*(volatile uint32_t *)(addr))

#define MAX_DMA_LEN 64

struct VolatileField {

volatile uint32_t len;

};

volatile uint32_t mmio_len_reg;

struct VolatileField vf;

static void bad_read_reg(char *dst, char *src) {

uint32_t len = READ_REG(0x40001000); // $ Source

memcpy(dst, src, len); // $ Alert

}

static void bad_get_mmio(char *dst, char *src) {

uint32_t len = GET_MMIO(0x50000000); // $ Source

memmove(dst, src, len); // $ Alert

}

static void bad_reg_read(char *dst, char *src) {

uint32_t len = REG_READ(0x51000000); // $ Source

strncpy(dst, src, len); // $ Alert

}

static void bad_dma_read(char *dst, char *src) {

uint32_t len = DMA_READ(0x60000000); // $ Source

memcpy(dst, src, len); // $ Alert

}

static void good_bounded(char *dst, char *src) {

uint32_t len = READ_REG(0x40001000);

if (len <= MAX_DMA_LEN)

memcpy(dst, src, len); // GOOD

}

static void good_early_return(char *dst, char *src) {

uint32_t len = DMA_READ(0x60000000);

if (len > MAX_DMA_LEN)

return;

memcpy(dst, src, len); // GOOD

}

static void good_constant_size(char *dst, char *src) {

uint32_t len = READ_REG(0x40001000);

memcpy(dst, src, 32); // GOOD — constant size, not tainted sink

}

static void negative_volatile_global(char *dst, char *src) {

uint32_t len = mmio_len_reg;

memcpy(dst, src, len); // GOOD

}

static void negative_volatile_field(char *dst, char *src) {

uint32_t len = vf.len;

memcpy(dst, src, len); // GOOD

}

static void negative_volatile_deref(char *dst, char *src) {

volatile uint32_t *reg = (volatile uint32_t *)0x40001000;

uint32_t len = *reg;

memcpy(dst, src, len); // GOOD

}

static uint32_t GET_MMIO_fn(unsigned long addr);

static void negative_get_mmio_function(char *dst, char *src) {

uint32_t len = GET_MMIO_fn(0x50000000);

memcpy(dst, src, len); // GOOD

}