Commit ca4f667
committed
add fallback if I can't easily determine the variable
1 parent 8b220cc commit ca4f667
3 files changed
Lines changed: 24 additions & 10 deletions
File tree
- java/ql
- src/Likely Bugs/Arithmetic
- test/query-tests/security/CWE-190/semmle/tests
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -27,17 +27,23 @@ class DangerousAssignOpExpr extends AssignOp { | |||
| 27 | 27 | ||
| 28 | 28 | predicate problematicCasting(Type t, Expr e) { e.getType().(NumType).widerThan(t) } | |
| 29 | 29 | ||
| 30 | - Variable getVariable(DangerousAssignOpExpr a) { | ||
| 31 | - result = a.getDest().(VarAccess).getVariable() | ||
| 30 | + Variable getVariable(Expr dest) { | ||
| 31 | + result = dest.(VarAccess).getVariable() | ||
| 32 | 32 | or | |
| 33 | - result = a.getDest().(ArrayAccess).getArray().(VarAccess).getVariable() | ||
| 33 | + result = dest.(ArrayAccess).getArray().(VarAccess).getVariable() | ||
| 34 | 34 | } | |
| 35 | 35 | ||
| 36 | - from DangerousAssignOpExpr a, Expr e, Variable v | ||
| 36 | + from DangerousAssignOpExpr a, Expr e, Top v | ||
| 37 | 37 | where | |
| 38 | 38 | e = a.getSource() and | |
| 39 | 39 | problematicCasting(a.getDest().getType(), e) and | |
| 40 | - v = getVariable(a) | ||
| 40 | + ( | ||
| 41 | + v = getVariable(a.getDest()) | ||
| 42 | + or | ||
| 43 | + // fallback, in case we can't easily determine the variable | ||
| 44 | + not exists(getVariable(a.getDest())) and | ||
| 45 | + v = a.getDest() | ||
| 46 | + ) | ||
| 41 | 47 | select a, | |
| 42 | - "Implicit cast of source $@ to narrower destination type " + a.getDest().getType().getName() + ".", | ||
| 43 | - v, "type " + e.getType().getName() | ||
| 48 | + "Implicit cast of $@ to narrower destination type " + a.getDest().getType().getName() + ".", | ||
| 49 | + v, "source type " + e.getType().getName() | ||
Lines changed: 4 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1,3 +1,4 @@ | |||
| 1 | - | Test.java:68:5:68:25 | ...+=... | Implicit cast of source $@ to narrower destination type int. | Test.java:64:4:64:13 | int i | type long | | ||
| 2 | - | Test.java:87:4:87:9 | ...+=... | Implicit cast of source $@ to narrower destination type int. | Test.java:81:4:81:13 | int i | type long | | ||
| 3 | - | Test.java:289:5:289:30 | ...+=... | Implicit cast of source $@ to narrower destination type int. | Test.java:285:4:285:27 | int[] arr | type long | | ||
| 1 | + | Test.java:68:5:68:25 | ...+=... | Implicit cast of $@ to narrower destination type int. | Test.java:64:4:64:13 | int i | source type long | | ||
| 2 | + | Test.java:87:4:87:9 | ...+=... | Implicit cast of $@ to narrower destination type int. | Test.java:81:4:81:13 | int i | source type long | | ||
| 3 | + | Test.java:289:5:289:30 | ...+=... | Implicit cast of $@ to narrower destination type int. | Test.java:285:4:285:27 | int[] arr | source type long | | ||
| 4 | + | Test.java:293:7:293:44 | ...+=... | Implicit cast of $@ to narrower destination type int. | Test.java:293:7:293:24 | ...[...] | source type long | | ||
Lines changed: 7 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -288,13 +288,20 @@ public static void main(String[] args) { | |||
| 288 | 288 | // which will result in overflows if it is large | |
| 289 | 289 | arr[2] += getLargeNumber(); | |
| 290 | 290 | } | |
| 291 | + | ||
| 292 | + // BAD. | ||
| 293 | + getAnIntArray()[0] += getLargeNumber(); | ||
| 291 | 294 | } | |
| 292 | 295 | } | |
| 293 | 296 | ||
| 294 | 297 | public static long getLargeNumber() { | |
| 295 | 298 | return Long.MAX_VALUE / 2; | |
| 296 | 299 | } | |
| 297 | 300 | ||
| 301 | + public static int[] getAnIntArray() { | ||
| 302 | + return new int[10]; | ||
| 303 | + } | ||
| 304 | + | ||
| 298 | 305 | public static boolean properlyBounded(int i) { | |
| 299 | 306 | return i < Integer.MAX_VALUE; | |
| 300 | 307 | } | |
0 commit comments