FazBrowse GitHub Viewer
|
Trending
|
URL:
|
Home
Tools:
[Download Repo ZIP]
[View Raw Code]
[Original HTTPS Page]
codeql/cpp/ql/src/Critical/OverflowStatic.ql at codeql-cli-2.19.2 · github/codeql · GitHub
github
/
codeql
Public
Notifications
You must be signed in to change notification settings
Fork
2.1k
Star
10.1k
Code
Issues
1k
Pull requests
470
Discussions
Actions
Projects
Security and quality
0
Insights
Additional navigation options
Code
Issues
Pull requests
Discussions
Actions
Projects
Security and quality
Insights
Expand file tree
Breadcrumbs
codeql
/
cpp
/
ql
/
src
/
Critical
/
OverflowStatic.ql
Copy path
More file actions
More file actions
Latest commit
History
History
History
154 lines (139 loc) · 5.04 KB
Breadcrumbs
codeql
/
cpp
/
ql
/
src
/
Critical
/
OverflowStatic.ql
Copy path
File metadata and controls
154 lines (139 loc) · 5.04 KB
Raw
Copy raw file
Download raw file
Open symbols panel
Edit and raw actions
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
/**
* @name Static array access may cause overflow
* @description Exceeding the size of a static array during write or access operations
* may result in a buffer overflow.
* @kind problem
* @problem.severity warning
* @security-severity 9.3
* @precision high
* @id cpp/static-buffer-overflow
* @tags reliability
* security
* external/cwe/cwe-119
* external/cwe/cwe-131
*/
import
cpp
import
semmle.code.cpp.commons.Buffer
import
semmle.code.cpp.ir.dataflow.DataFlow
import
semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
import
LoopBounds
private
predicate
staticBufferBase
(
VariableAccess
access
,
Variable
v
)
{
v
.
getType
(
)
.
(
ArrayType
)
.
getBaseType
(
)
instanceof
CharType
and
access
=
v
.
getAnAccess
(
)
and
not
memberMayBeVarSize
(
_
,
v
)
and
not
access
.
isUnevaluated
(
)
}
predicate
staticBuffer
(
VariableAccess
access
,
Variable
v
,
int
size
)
{
staticBufferBase
(
access
,
v
)
and
size
=
getBufferSize
(
access
,
_
)
}
class
BufferAccess
extends
ArrayExpr
{
BufferAccess
(
)
{
exists
(
int
size
|
staticBuffer
(
this
.
getArrayBase
(
)
,
_
,
size
)
and
size
!=
0
)
and
// exclude accesses in macro implementation of `strcmp`,
// which are carefully controlled but can look dangerous.
not
exists
(
Macro
m
|
m
.
getName
(
)
=
"strcmp"
and
m
.
getAnInvocation
(
)
.
getAnExpandedElement
(
)
=
this
)
and
//A buffer access must be reachable (not in dead code)
reachable
(
this
)
}
int
bufferSize
(
)
{
staticBuffer
(
this
.
getArrayBase
(
)
,
_
,
result
)
}
Variable
buffer
(
)
{
result
.
getAnAccess
(
)
=
this
.
getArrayBase
(
)
}
}
predicate
overflowOffsetInLoop
(
BufferAccess
bufaccess
,
string
msg
)
{
exists
(
ClassicForLoop
loop
|
loop
.
getStmt
(
)
.
getAChild
*
(
)
=
bufaccess
.
getEnclosingStmt
(
)
and
loop
.
limit
(
)
>=
bufaccess
.
bufferSize
(
)
and
loop
.
counter
(
)
.
getAnAccess
(
)
=
bufaccess
.
getArrayOffset
(
)
and
// Ensure that we don't have an upper bound on the array index that's less than the buffer size.
not
upperBound
(
bufaccess
.
getArrayOffset
(
)
.
getFullyConverted
(
)
)
<
bufaccess
.
bufferSize
(
)
and
// The upper bounds analysis must not have been widended
not
upperBoundMayBeWidened
(
bufaccess
.
getArrayOffset
(
)
.
getFullyConverted
(
)
)
and
msg
=
"Potential buffer-overflow: counter '"
+
loop
.
counter
(
)
.
toString
(
)
+
"' <= "
+
loop
.
limit
(
)
.
toString
(
)
+
" but '"
+
bufaccess
.
buffer
(
)
.
getName
(
)
+
"' has "
+
bufaccess
.
bufferSize
(
)
.
toString
(
)
+
" elements."
)
}
predicate
bufferAndSizeFunction
(
Function
f
,
int
buf
,
int
size
)
{
f
.
hasGlobalName
(
"read"
)
and
buf
=
1
and
size
=
2
or
f
.
hasGlobalOrStdName
(
"fgets"
)
and
buf
=
0
and
size
=
1
or
f
.
hasGlobalOrStdName
(
"strncpy"
)
and
buf
=
0
and
size
=
2
or
f
.
hasGlobalOrStdName
(
"strncat"
)
and
buf
=
0
and
size
=
2
or
f
.
hasGlobalOrStdName
(
"memcpy"
)
and
buf
=
0
and
size
=
2
or
f
.
hasGlobalOrStdName
(
"memmove"
)
and
buf
=
0
and
size
=
2
or
f
.
hasGlobalOrStdName
(
"snprintf"
)
and
buf
=
0
and
size
=
1
or
f
.
hasGlobalOrStdName
(
"vsnprintf"
)
and
buf
=
0
and
size
=
1
}
class
CallWithBufferSize
extends
FunctionCall
{
CallWithBufferSize
(
)
{
bufferAndSizeFunction
(
this
.
getTarget
(
)
,
_
,
_
)
}
Expr
buffer
(
)
{
exists
(
int
i
|
bufferAndSizeFunction
(
this
.
getTarget
(
)
,
i
,
_
)
and
result
=
this
.
getArgument
(
i
)
)
}
Expr
statedSizeExpr
(
)
{
exists
(
int
i
|
bufferAndSizeFunction
(
this
.
getTarget
(
)
,
_
,
i
)
and
result
=
this
.
getArgument
(
i
)
)
}
int
statedSizeValue
(
)
{
// `upperBound(e)` defaults to `exprMaxVal(e)` when `e` isn't analyzable. So to get a meaningful
// result in this case we pick the minimum value obtainable from dataflow and range analysis.
result
=
upperBound
(
this
.
statedSizeExpr
(
)
)
.
minimum
(
min
(
Expr
statedSizeSrc
|
DataFlow
::
localExprFlow
(
statedSizeSrc
,
this
.
statedSizeExpr
(
)
)
|
statedSizeSrc
.
getValue
(
)
.
toInt
(
)
)
)
}
}
predicate
wrongBufferSize
(
Expr
error
,
string
msg
)
{
exists
(
CallWithBufferSize
call
,
int
bufsize
,
Variable
buf
,
int
statedSize
|
staticBuffer
(
call
.
buffer
(
)
,
buf
,
bufsize
)
and
statedSize
=
call
.
statedSizeValue
(
)
and
statedSize
>
bufsize
and
error
=
call
.
statedSizeExpr
(
)
and
msg
=
"Potential buffer-overflow: '"
+
buf
.
getName
(
)
+
"' has size "
+
bufsize
.
toString
(
)
+
" not "
+
statedSize
+
"."
)
}
predicate
outOfBounds
(
BufferAccess
bufaccess
,
string
msg
)
{
exists
(
int
size
,
int
access
,
string
buf
|
buf
=
bufaccess
.
buffer
(
)
.
getName
(
)
and
bufaccess
.
bufferSize
(
)
=
size
and
bufaccess
.
getArrayOffset
(
)
.
getValue
(
)
.
toInt
(
)
=
access
and
(
access
>
size
or
access
=
size
and
not
exists
(
AddressOfExpr
addof
|
bufaccess
=
addof
.
getOperand
(
)
)
and
not
exists
(
BuiltInOperationBuiltInOffsetOf
offsetof
|
offsetof
.
getAChild
(
)
=
bufaccess
)
)
and
msg
=
"Potential buffer-overflow: '"
+
buf
+
"' has size "
+
size
.
toString
(
)
+
" but '"
+
buf
+
"["
+
access
.
toString
(
)
+
"]' may be accessed here."
)
}
from
Element
error
,
string
msg
where
overflowOffsetInLoop
(
error
,
msg
)
or
wrongBufferSize
(
error
,
msg
)
or
outOfBounds
(
error
,
msg
)
select
error
,
msg
Back
|
FazBrowse Home
|
New Git URL