FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
codeql/cpp/ql/src/Critical/MissingCheckScanf.ql at codeql-cli/v2.16.0 · github/codeql · GitHub
Uh oh!
There was an error while loading.
Please reload this page
.
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
10k
Code
Issues
998
Pull requests
462
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
codeql
/
cpp
/
ql
/
src
/
Critical
/
MissingCheckScanf.ql
Copy path
More file actions
More file actions
Latest commit
History
History
History
205 lines (187 loc) · 5.82 KB
Breadcrumbs
codeql
/
cpp
/
ql
/
src
/
Critical
/
MissingCheckScanf.ql
Copy path
File metadata and controls
205 lines (187 loc) · 5.82 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
/**
* @name Missing return-value check for a 'scanf'-like function
* @description Failing to check that a call to 'scanf' actually writes to an
* output variable can lead to unexpected behavior at reading time.
* @kind problem
* @problem.severity warning
* @security-severity 7.5
* @precision medium
* @id cpp/missing-check-scanf
* @tags security
* correctness
* external/cwe/cwe-252
* external/cwe/cwe-253
*/
import
cpp
import
semmle.code.cpp.commons.Scanf
import
semmle.code.cpp.controlflow.Guards
import
semmle.code.cpp.dataflow.new.DataFlow
::
DataFlow
import
semmle.code.cpp.ir.IR
import
semmle.code.cpp.ir.ValueNumbering
import
ScanfChecks
/** Holds if `n` reaches an argument to a call to a `scanf`-like function. */
pragma
[
nomagic
]
predicate
revFlow0
(
Node
n
)
{
isSink
(
_
,
_
,
n
,
_
)
or
exists
(
Node
succ
|
revFlow0
(
succ
)
|
localFlowStep
(
n
,
succ
)
)
}
/**
* Holds if `n` represents an uninitialized stack-allocated variable, or a
* newly (and presumed uninitialized) heap allocation.
*/
predicate
isUninitialized
(
Node
n
)
{
exists
(
n
.
asUninitialized
(
)
)
or
n
.
asIndirectExpr
(
1
)
instanceof
AllocationExpr
}
pragma
[
nomagic
]
predicate
fwdFlow0
(
Node
n
)
{
revFlow0
(
n
)
and
(
isUninitialized
(
n
)
or
exists
(
Node
prev
|
fwdFlow0
(
prev
)
and
localFlowStep
(
prev
,
n
)
)
)
}
predicate
isSink
(
ScanfFunctionCall
call
,
int
index
,
Node
n
,
Expr
input
)
{
input
=
call
.
getOutputArgument
(
index
)
and
n
.
asIndirectExpr
(
)
=
input
}
/**
* Holds if `call` is a `scanf`-like call and `output` is the `index`'th
* argument that has not been previously initialized.
*/
predicate
isRelevantScanfCall
(
ScanfFunctionCall
call
,
int
index
,
Expr
output
)
{
exists
(
Node
n
|
fwdFlow0
(
n
)
and
isSink
(
call
,
index
,
n
,
output
)
)
and
// Exclude results from incorrectky checked scanf query
not
incorrectlyCheckedScanf
(
call
)
}
/**
* Holds if `call` is a `scanf`-like function that may write to `output` at
* index `index` and `n` is the dataflow node that represents the data after
* it has been written to by `call`.
*/
predicate
isSource
(
ScanfFunctionCall
call
,
int
index
,
Node
n
,
Expr
output
)
{
isRelevantScanfCall
(
call
,
index
,
output
)
and
output
=
call
.
getOutputArgument
(
index
)
and
n
.
asDefiningArgument
(
)
=
output
}
/**
* Holds if `n` is reachable from an output argument of a relevant call to
* a `scanf`-like function.
*/
pragma
[
nomagic
]
predicate
fwdFlow
(
Node
n
)
{
isSource
(
_
,
_
,
n
,
_
)
or
exists
(
Node
prev
|
fwdFlow
(
prev
)
and
localFlowStep
(
prev
,
n
)
and
not
isSanitizerOut
(
prev
)
)
}
/** Holds if `n` should not have outgoing flow. */
predicate
isSanitizerOut
(
Node
n
)
{
// We disable flow out of sinks to reduce result duplication
isSink
(
n
,
_
)
or
// If the node is being passed to a function it may be
// modified, and thus it's safe to later read the value.
exists
(
n
.
asIndirectArgument
(
)
)
}
/**
* Holds if `n` is a node such that `n.asExpr() = e` and `e` is not an
* argument of a deallocation expression.
*/
predicate
isSink
(
Node
n
,
Expr
e
)
{
n
.
asExpr
(
)
=
e
and
not
any
(
DeallocationExpr
dealloc
)
.
getFreedExpr
(
)
=
e
}
/**
* Holds if `n` is part of a path from a call to a `scanf`-like function
* to a use of the written variable.
*/
pragma
[
nomagic
]
predicate
revFlow
(
Node
n
)
{
fwdFlow
(
n
)
and
(
isSink
(
n
,
_
)
or
exists
(
Node
succ
|
revFlow
(
succ
)
and
localFlowStep
(
n
,
succ
)
and
not
isSanitizerOut
(
n
)
)
)
}
/** A local flow step, restricted to relevant dataflow nodes. */
private
predicate
step
(
Node
n1
,
Node
n2
)
{
revFlow
(
n1
)
and
revFlow
(
n2
)
and
localFlowStep
(
n1
,
n2
)
}
predicate
hasFlow
(
Node
n1
,
Node
n2
)
=
fastTC
(
step
/
2
)
(
n1
,
n2
)
/**
* Holds if `source` is the `index`'th argument to the `scanf`-like call `call`, and `sink` is
* a dataflow node that represents the expression `e`.
*/
predicate
hasFlow
(
Node
source
,
ScanfFunctionCall
call
,
int
index
,
Node
sink
,
Expr
e
)
{
isSource
(
call
,
index
,
source
,
_
)
and
hasFlow
(
source
,
sink
)
and
isSink
(
sink
,
e
)
}
/**
* Gets the smallest possible `scanf` return value of `call` that would indicate
* success in writing the output argument at index `index`.
*/
int
getMinimumGuardConstant
(
ScanfFunctionCall
call
,
int
index
)
{
isSource
(
call
,
index
,
_
,
_
)
and
result
=
index
+
1
-
count
(
ScanfFormatLiteral
f
,
int
n
|
// Special case: %n writes to an argument without reading any input.
// It does not increase the count returned by `scanf`.
n
<=
index
and
f
.
getUse
(
)
=
call
and
f
.
getConversionChar
(
n
)
=
"n"
)
}
/**
* Holds the access to `e` isn't guarded by a check that ensures that `call` returned
* at least `minGuard`.
*/
predicate
hasNonGuardedAccess
(
ScanfFunctionCall
call
,
Expr
e
,
int
minGuard
)
{
exists
(
int
index
|
hasFlow
(
_
,
call
,
index
,
_
,
e
)
and
minGuard
=
getMinimumGuardConstant
(
call
,
index
)
|
not
exists
(
int
value
|
e
.
getBasicBlock
(
)
=
blockGuardedBy
(
value
,
"=="
,
call
)
and
minGuard
<=
value
or
e
.
getBasicBlock
(
)
=
blockGuardedBy
(
value
,
"<"
,
call
)
and
minGuard
-
1
<=
value
or
e
.
getBasicBlock
(
)
=
blockGuardedBy
(
value
,
"<="
,
call
)
and
minGuard
<=
value
)
)
}
/** Returns a block guarded by the assertion of `value op call` */
BasicBlock
blockGuardedBy
(
int
value
,
string
op
,
ScanfFunctionCall
call
)
{
exists
(
GuardCondition
g
,
Expr
left
,
Expr
right
|
right
=
g
.
getAChild
(
)
and
value
=
left
.
getValue
(
)
.
toInt
(
)
and
localExprFlow
(
call
,
right
)
|
g
.
ensuresEq
(
left
,
right
,
0
,
result
,
true
)
and
op
=
"=="
or
g
.
ensuresLt
(
left
,
right
,
0
,
result
,
true
)
and
op
=
"<"
or
g
.
ensuresLt
(
left
,
right
,
1
,
result
,
true
)
and
op
=
"<="
)
}
from
ScanfFunctionCall
call
,
Expr
e
,
int
minGuard
where
hasNonGuardedAccess
(
call
,
e
,
minGuard
)
select
e
,
"This variable is read, but may not have been written. "
+
"It should be guarded by a check that the $@ returns at least "
+
minGuard
+
"."
,
call
,
call
.
toString
(
)
Back
|
FazBrowse Home
|
New Git URL