FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

also get the variable for array accesses · github/codeql@8b220cc · GitHub

/ codeql Public

Commit 8b220cc

Browse files
erik-krogh
committed
also get the variable for array accesses
1 parent 795b767 commit 8b220cc

3 files changed

Lines changed: 18 additions & 1 deletion

File tree

‎java/ql/src/Likely Bugs/Arithmetic/InformationLoss.ql‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,17 @@ class DangerousAssignOpExpr extends AssignOp {
2727

2828
predicate problematicCasting(Type t, Expr e) { e.getType().(NumType).widerThan(t) }
2929

30+
Variable getVariable(DangerousAssignOpExpr a) {
31+
result = a.getDest().(VarAccess).getVariable()
32+
or
33+
result = a.getDest().(ArrayAccess).getArray().(VarAccess).getVariable()
34+
}
35+
3036
from DangerousAssignOpExpr a, Expr e, Variable v
3137
where
3238
e = a.getSource() and
3339
problematicCasting(a.getDest().getType(), e) and
34-
v = a.getDest().(VarAccess).getVariable()
40+
v = getVariable(a)
3541
select a,
3642
"Implicit cast of source $@ to narrower destination type " + a.getDest().getType().getName() + ".",
3743
v, "type " + e.getType().getName()

‎java/ql/test/query-tests/security/CWE-190/semmle/tests/InformationLoss.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
| Test.java:68:5:68:25 | ...+=... | Implicit cast of source $@ to narrower destination type int. | Test.java:64:4:64:13 | int i | type long |
22
| Test.java:87:4:87:9 | ...+=... | Implicit cast of source $@ to narrower destination type int. | Test.java:81:4:81:13 | int i | type long |
3+
| Test.java:289:5:289:30 | ...+=... | Implicit cast of source $@ to narrower destination type int. | Test.java:285:4:285:27 | int[] arr | type long |

‎java/ql/test/query-tests/security/CWE-190/semmle/tests/Test.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,16 @@ public static void main(String[] args) {
279279
// subsequently cast to narrower type int
280280
int widenedThenNarrowed = (int) (data2 + 10L);
281281
}
282+
283+
// InformationLoss
284+
{
285+
int[] arr = new int[10];
286+
while (arr[2] < 1000000) {
287+
// BAD: getLargeNumber is implicitly narrowed to an integer
288+
// which will result in overflows if it is large
289+
arr[2] += getLargeNumber();
290+
}
291+
}
282292
}
283293

284294
public static long getLargeNumber() {

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL