From e95ebb25a58d4751d5444723391cd9daa49c0904 Mon Sep 17 00:00:00 2001 From: Jonas Jensen Date: Sat, 15 Feb 2020 21:04:53 +0100 Subject: [PATCH 1/4] C++: Ensure tainted_diff.ql keeps using old lib Without this, the test will compare the IR to itself after we enable it. --- .../test/library-tests/dataflow/security-taint/tainted_diff.ql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql index 9a90a898d7f0..13a1b7b6f3f2 100644 --- a/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql +++ b/cpp/ql/test/library-tests/dataflow/security-taint/tainted_diff.ql @@ -1,4 +1,4 @@ -import semmle.code.cpp.security.TaintTracking as AST +import semmle.code.cpp.security.TaintTrackingImpl as AST import semmle.code.cpp.ir.dataflow.DefaultTaintTracking as IR import cpp From f4ba56f0c01623f03393a9d8c2f2f40c412349f0 Mon Sep 17 00:00:00 2001 From: Jonas Jensen Date: Wed, 12 Feb 2020 15:37:11 +0100 Subject: [PATCH 2/4] C++: Use IR for security.TaintTracking and GVN --- cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll | 2 +- .../src/semmle/code/cpp/valuenumbering/GlobalValueNumbering.qll | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll b/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll index 27870fb3671a..e20dfd83efde 100644 --- a/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll +++ b/cpp/ql/src/semmle/code/cpp/security/TaintTracking.qll @@ -2,4 +2,4 @@ * Support for tracking tainted data through the program. */ -import TaintTrackingImpl +import semmle.code.cpp.ir.dataflow.DefaultTaintTracking diff --git a/cpp/ql/src/semmle/code/cpp/valuenumbering/GlobalValueNumbering.qll b/cpp/ql/src/semmle/code/cpp/valuenumbering/GlobalValueNumbering.qll index 7a2d43a26e09..cb28edc07b99 100644 --- a/cpp/ql/src/semmle/code/cpp/valuenumbering/GlobalValueNumbering.qll +++ b/cpp/ql/src/semmle/code/cpp/valuenumbering/GlobalValueNumbering.qll @@ -1 +1 @@ -import GlobalValueNumberingImpl +import semmle.code.cpp.ir.internal.ASTValueNumbering From a59c0faceeb7fe2c131c8e3263147fb57b7f0ce0 Mon Sep 17 00:00:00 2001 From: Jonas Jensen Date: Sat, 15 Feb 2020 21:08:04 +0100 Subject: [PATCH 3/4] C++: Accept test changes for IR libs This is for the tests in the ql repo. There are also changed tests in the internal repo. --- .../dataflow/security-taint/tainted.expected | 22 +-- .../GlobalValueNumbering.expected | 82 +++++----- .../GlobalValueNumbering/Uniqueness.expected | 58 +++++++ .../diff_ir_expr.expected | 142 ------------------ .../StrncpyFlippedArgs.expected | 3 +- .../semmle/tests/UnboundedWrite.expected | 5 + .../ImproperArrayIndexValidation.expected | 1 - .../CWE-134/semmle/argv/argvLocal.expected | 8 - .../CWE-134/semmle/funcs/funcsLocal.expected | 3 - .../CWE/CWE-134/semmle/ifs/ifs.expected | 1 + .../TaintedAllocationSize.expected | 4 +- .../ArithmeticWithExtremeValues.expected | 1 - .../ArithmeticUncontrolled.expected | 1 - .../TaintedCondition.expected | 1 + 14 files changed, 116 insertions(+), 216 deletions(-) diff --git a/cpp/ql/test/library-tests/dataflow/security-taint/tainted.expected b/cpp/ql/test/library-tests/dataflow/security-taint/tainted.expected index 7359b068d8ea..114c213ff54f 100644 --- a/cpp/ql/test/library-tests/dataflow/security-taint/tainted.expected +++ b/cpp/ql/test/library-tests/dataflow/security-taint/tainted.expected @@ -15,39 +15,27 @@ | test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:28 | call to getenv | | | test.cpp:38:23:38:28 | call to getenv | test.cpp:38:23:38:40 | (const char *)... | | | test.cpp:38:23:38:28 | call to getenv | test.cpp:40:14:40:19 | envStr | | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:8:24:8:25 | s1 | envStrGlobal | +| test.cpp:49:23:49:28 | call to getenv | test.cpp:8:24:8:25 | s1 | | | test.cpp:49:23:49:28 | call to getenv | test.cpp:45:13:45:24 | envStrGlobal | | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:45:13:45:24 | envStrGlobal | envStrGlobal | | test.cpp:49:23:49:28 | call to getenv | test.cpp:49:14:49:19 | envStr | | | test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:28 | call to getenv | | | test.cpp:49:23:49:28 | call to getenv | test.cpp:49:23:49:40 | (const char *)... | | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:50:15:50:24 | envStr_ptr | | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:50:15:50:24 | envStr_ptr | envStrGlobal | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:50:28:50:40 | & ... | envStrGlobal | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:50:29:50:40 | envStrGlobal | envStrGlobal | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:2:52:12 | * ... | | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:52:3:52:12 | envStr_ptr | | | test.cpp:49:23:49:28 | call to getenv | test.cpp:52:16:52:21 | envStr | | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:6:54:35 | ! ... | envStrGlobal | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:12 | call to strcmp | envStrGlobal | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:35 | (bool)... | envStrGlobal | -| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:14:54:25 | envStrGlobal | envStrGlobal | +| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:6:54:35 | ! ... | | +| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:12 | call to strcmp | | +| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:7:54:35 | (bool)... | | +| test.cpp:49:23:49:28 | call to getenv | test.cpp:54:14:54:25 | envStrGlobal | | | test.cpp:60:29:60:34 | call to getenv | test.cpp:10:27:10:27 | s | | | test.cpp:60:29:60:34 | call to getenv | test.cpp:60:18:60:25 | userName | | | test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:34 | call to getenv | | | test.cpp:60:29:60:34 | call to getenv | test.cpp:60:29:60:47 | (const char *)... | | | test.cpp:60:29:60:34 | call to getenv | test.cpp:64:25:64:32 | userName | | -| test.cpp:68:28:68:33 | call to getenv | test.cpp:11:20:11:21 | s1 | | | test.cpp:68:28:68:33 | call to getenv | test.cpp:11:36:11:37 | s2 | | -| test.cpp:68:28:68:33 | call to getenv | test.cpp:67:7:67:13 | copying | | | test.cpp:68:28:68:33 | call to getenv | test.cpp:68:17:68:24 | userName | | | test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:33 | call to getenv | | | test.cpp:68:28:68:33 | call to getenv | test.cpp:68:28:68:46 | (const char *)... | | -| test.cpp:68:28:68:33 | call to getenv | test.cpp:69:10:69:13 | copy | | | test.cpp:68:28:68:33 | call to getenv | test.cpp:70:5:70:10 | call to strcpy | | -| test.cpp:68:28:68:33 | call to getenv | test.cpp:70:12:70:15 | copy | | | test.cpp:68:28:68:33 | call to getenv | test.cpp:70:18:70:25 | userName | | -| test.cpp:68:28:68:33 | call to getenv | test.cpp:71:12:71:15 | copy | | | test.cpp:75:20:75:25 | call to getenv | test.cpp:15:22:15:25 | nptr | | | test.cpp:75:20:75:25 | call to getenv | test.cpp:75:15:75:18 | call to atoi | | | test.cpp:75:20:75:25 | call to getenv | test.cpp:75:20:75:25 | call to getenv | | diff --git a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/GlobalValueNumbering.expected b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/GlobalValueNumbering.expected index d5d46ee0b72d..052ecf509216 100644 --- a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/GlobalValueNumbering.expected +++ b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/GlobalValueNumbering.expected @@ -1,40 +1,42 @@ -| test.cpp:5:3:5:3 | x | 5:c3-c3 6:c3-c3 | -| test.cpp:5:7:5:8 | p0 | 5:c7-c8 6:c7-c8 | -| test.cpp:5:7:5:13 | ... + ... | 5:c7-c13 6:c7-c13 7:c7-c7 | -| test.cpp:5:12:5:13 | p1 | 5:c12-c13 6:c12-c13 | -| test.cpp:16:3:16:3 | x | 16:c3-c3 17:c3-c3 | -| test.cpp:16:7:16:8 | p0 | 16:c7-c8 17:c7-c8 | -| test.cpp:16:7:16:13 | ... + ... | 16:c7-c13 17:c7-c13 | -| test.cpp:16:7:16:24 | ... + ... | 16:c7-c24 17:c7-c24 18:c7-c7 | -| test.cpp:16:12:16:13 | p1 | 16:c12-c13 17:c12-c13 | -| test.cpp:16:17:16:24 | global01 | 16:c17-c24 17:c17-c24 | -| test.cpp:29:7:29:8 | p0 | 29:c7-c8 31:c7-c8 | -| test.cpp:29:7:29:13 | ... + ... | 29:c7-c13 31:c7-c13 | -| test.cpp:29:12:29:13 | p1 | 29:c12-c13 31:c12-c13 | -| test.cpp:31:7:31:24 | ... + ... | 31:c7-c24 32:c7-c7 | -| test.cpp:43:7:43:8 | p0 | 43:c7-c8 45:c7-c8 | -| test.cpp:43:7:43:13 | ... + ... | 43:c7-c13 45:c7-c13 | -| test.cpp:43:12:43:13 | p1 | 43:c12-c13 45:c12-c13 | -| test.cpp:44:9:44:9 | 0 | 44:c9-c9 51:c25-c25 53:c18-c21 56:c39-c42 59:c17-c20 88:c12-c12 | -| test.cpp:45:7:45:24 | ... + ... | 45:c7-c24 46:c7-c7 | -| test.cpp:53:10:53:13 | (int)... | 53:c10-c13 56:c21-c24 | -| test.cpp:53:10:53:13 | * ... | 53:c10-c13 56:c21-c24 | -| test.cpp:53:11:53:13 | str | 53:c11-c13 56:c22-c24 | -| test.cpp:53:18:53:21 | 0 | 53:c18-c21 56:c39-c42 59:c17-c20 | -| test.cpp:56:13:56:16 | (int)... | 56:c13-c16 56:c31-c34 59:c9-c12 | -| test.cpp:56:13:56:16 | * ... | 56:c13-c16 56:c31-c34 59:c9-c12 | -| test.cpp:56:14:56:16 | ptr | 56:c14-c16 56:c32-c34 56:c47-c49 59:c10-c12 | -| test.cpp:62:5:62:10 | result | 62:c5-c10 65:c10-c15 | -| test.cpp:77:20:77:30 | (signed short)... | 77:c20-c30 79:c7-c7 | -| test.cpp:79:11:79:14 | vals | 79:c11-c14 79:c24-c27 | -| test.cpp:105:11:105:12 | (Base *)... | 105:c11-c12 106:c14-c35 107:c11-c12 | -| test.cpp:105:11:105:12 | pd | 105:c11-c12 106:c33-c34 | -| test.cpp:105:15:105:15 | b | 105:c15-c15 107:c15-c15 109:c10-c10 | -| test.cpp:125:11:125:12 | pa | 125:c11-c12 126:c11-c12 128:c3-c4 129:c11-c12 | -| test.cpp:125:15:125:15 | x | 125:c15-c15 126:c15-c15 128:c7-c7 | -| test.cpp:136:11:136:18 | global_a | 136:c11-c18 137:c11-c18 139:c3-c10 | -| test.cpp:136:21:136:21 | x | 136:c21-c21 137:c21-c21 139:c13-c13 | -| test.cpp:144:11:144:12 | pa | 144:c11-c12 145:c11-c12 147:c3-c4 149:c11-c12 | -| test.cpp:145:15:145:15 | y | 145:c15-c15 147:c7-c7 | -| test.cpp:153:11:153:18 | global_a | 153:c11-c18 154:c11-c18 156:c3-c10 | -| test.cpp:153:21:153:21 | x | 153:c21-c21 154:c21-c21 | +| test.cpp:5:3:5:3 | GVN | 5:c3-c3 6:c3-c3 | +| test.cpp:5:7:5:8 | GVN | 5:c7-c8 6:c7-c8 | +| test.cpp:5:7:5:13 | GVN | 5:c7-c13 6:c7-c13 7:c7-c7 | +| test.cpp:5:12:5:13 | GVN | 5:c12-c13 6:c12-c13 | +| test.cpp:16:3:16:3 | GVN | 16:c3-c3 17:c3-c3 | +| test.cpp:16:7:16:8 | GVN | 16:c7-c8 17:c7-c8 | +| test.cpp:16:7:16:13 | GVN | 16:c7-c13 17:c7-c13 | +| test.cpp:16:7:16:24 | GVN | 16:c7-c24 17:c7-c24 18:c7-c7 | +| test.cpp:16:12:16:13 | GVN | 16:c12-c13 17:c12-c13 | +| test.cpp:16:17:16:24 | GVN | 16:c17-c24 17:c17-c24 | +| test.cpp:29:3:29:3 | GVN | 29:c3-c3 31:c3-c3 | +| test.cpp:29:7:29:8 | GVN | 29:c7-c8 31:c7-c8 | +| test.cpp:29:7:29:13 | GVN | 29:c7-c13 31:c7-c13 | +| test.cpp:29:12:29:13 | GVN | 29:c12-c13 31:c12-c13 | +| test.cpp:31:7:31:24 | GVN | 31:c7-c24 32:c7-c7 | +| test.cpp:43:3:43:3 | GVN | 43:c3-c3 45:c3-c3 | +| test.cpp:43:7:43:8 | GVN | 43:c7-c8 45:c7-c8 | +| test.cpp:43:7:43:13 | GVN | 43:c7-c13 45:c7-c13 | +| test.cpp:43:7:43:24 | GVN | 43:c7-c24 45:c7-c24 46:c7-c7 | +| test.cpp:43:12:43:13 | GVN | 43:c12-c13 45:c12-c13 | +| test.cpp:43:17:43:24 | GVN | 43:c17-c24 45:c17-c24 | +| test.cpp:44:3:44:5 | GVN | 44:c3-c5 44:c4-c5 | +| test.cpp:53:10:53:13 | GVN | 53:c10-c13 56:c21-c24 | +| test.cpp:53:10:53:13 | GVN | 53:c10-c13 56:c21-c24 | +| test.cpp:53:11:53:13 | GVN | 53:c11-c13 56:c22-c24 | +| test.cpp:53:18:53:21 | GVN | 53:c18-c21 56:c39-c42 59:c17-c20 | +| test.cpp:56:14:56:16 | GVN | 56:c14-c16 56:c32-c34 56:c47-c49 59:c10-c12 | +| test.cpp:62:5:62:10 | GVN | 62:c5-c10 65:c10-c15 | +| test.cpp:77:20:77:28 | GVN | 77:c20-c28 79:c7-c7 | +| test.cpp:79:11:79:14 | GVN | 79:c11-c14 79:c24-c27 | +| test.cpp:92:11:92:16 | GVN | 92:c11-c16 92:c15-c16 93:c10-c10 | +| test.cpp:105:11:105:12 | GVN | 105:c11-c12 106:c33-c34 | +| test.cpp:105:11:105:12 | GVN | 105:c11-c12 106:c33-c34 107:c11-c12 | +| test.cpp:105:15:105:15 | GVN | 105:c15-c15 107:c15-c15 109:c10-c10 | +| test.cpp:113:3:113:5 | GVN | 113:c3-c5 115:c3-c5 | +| test.cpp:125:11:125:12 | GVN | 125:c11-c12 126:c11-c12 128:c3-c4 129:c11-c12 | +| test.cpp:125:15:125:15 | GVN | 125:c15-c15 126:c15-c15 | +| test.cpp:128:11:128:11 | GVN | 128:c11-c11 129:c15-c15 | +| test.cpp:136:11:136:18 | GVN | 136:c11-c18 137:c11-c18 139:c3-c10 | +| test.cpp:144:11:144:12 | GVN | 144:c11-c12 145:c11-c12 147:c3-c4 149:c11-c12 | +| test.cpp:144:15:144:15 | GVN | 144:c15-c15 149:c15-c15 | +| test.cpp:153:11:153:18 | GVN | 153:c11-c18 154:c11-c18 156:c3-c10 | diff --git a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/Uniqueness.expected b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/Uniqueness.expected index e69de29bb2d1..0aebaa26f602 100644 --- a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/Uniqueness.expected +++ b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/Uniqueness.expected @@ -0,0 +1,58 @@ +| test.cpp:5:3:5:13 | ... = ... | | +| test.cpp:6:3:6:13 | ... = ... | | +| test.cpp:7:3:7:7 | ... = ... | | +| test.cpp:10:16:10:16 | 1 | | +| test.cpp:16:3:16:24 | ... = ... | | +| test.cpp:17:3:17:24 | ... = ... | | +| test.cpp:18:3:18:7 | ... = ... | | +| test.cpp:21:16:21:16 | 2 | | +| test.cpp:29:3:29:24 | ... = ... | | +| test.cpp:30:3:30:17 | call to change_global02 | | +| test.cpp:31:3:31:24 | ... = ... | | +| test.cpp:32:3:32:7 | ... = ... | | +| test.cpp:35:16:35:16 | 3 | | +| test.cpp:43:3:43:24 | ... = ... | | +| test.cpp:44:3:44:9 | ... = ... | | +| test.cpp:45:3:45:24 | ... = ... | | +| test.cpp:46:3:46:7 | ... = ... | | +| test.cpp:51:25:51:25 | (unsigned int)... | | +| test.cpp:53:10:53:13 | (int)... | | +| test.cpp:53:10:53:13 | * ... | LoadTotalOverlap, Unary | +| test.cpp:53:18:53:21 | (int)... | | +| test.cpp:55:5:55:15 | ... = ... | | +| test.cpp:56:12:56:25 | (...) | | +| test.cpp:56:12:56:43 | ... && ... | | +| test.cpp:56:13:56:16 | (int)... | | +| test.cpp:56:13:56:16 | * ... | Unary, Unique | +| test.cpp:56:21:56:24 | (int)... | | +| test.cpp:56:21:56:24 | * ... | LoadTotalOverlap, Unary | +| test.cpp:56:30:56:43 | (...) | | +| test.cpp:56:31:56:34 | (int)... | | +| test.cpp:56:31:56:34 | * ... | Unary, Unique | +| test.cpp:56:39:56:42 | (int)... | | +| test.cpp:56:47:56:51 | ... ++ | | +| test.cpp:59:9:59:12 | (int)... | | +| test.cpp:59:9:59:12 | * ... | Unary, Unique | +| test.cpp:59:17:59:20 | (int)... | | +| test.cpp:62:5:62:12 | ... ++ | | +| test.cpp:77:20:77:28 | call to getAValue | Unary, Unique | +| test.cpp:77:20:77:30 | (signed short)... | | +| test.cpp:79:7:79:7 | (int)... | | +| test.cpp:79:7:79:7 | v | Unary, Unary | +| test.cpp:79:11:79:20 | (int)... | | +| test.cpp:79:17:79:20 | val1 | LoadTotalOverlap, Unary | +| test.cpp:79:24:79:33 | (int)... | | +| test.cpp:79:30:79:33 | val2 | LoadTotalOverlap, Unary | +| test.cpp:80:5:80:19 | ... = ... | | +| test.cpp:80:9:80:17 | call to getAValue | Unary, Unique | +| test.cpp:80:9:80:19 | (signed short)... | | +| test.cpp:88:3:88:20 | ... = ... | | +| test.cpp:88:12:88:12 | (void *)... | | +| test.cpp:105:11:105:12 | (Base *)... | | +| test.cpp:105:11:105:12 | pd | InheritanceConversion, InitializeParameter | +| test.cpp:106:14:106:35 | static_cast... | | +| test.cpp:106:33:106:34 | pd | InheritanceConversion, InitializeParameter | +| test.cpp:128:3:128:11 | ... = ... | | +| test.cpp:139:3:139:24 | ... = ... | | +| test.cpp:147:3:147:18 | ... = ... | | +| test.cpp:156:3:156:17 | ... = ... | | diff --git a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/diff_ir_expr.expected b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/diff_ir_expr.expected index cd44eb8572b7..e69de29bb2d1 100644 --- a/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/diff_ir_expr.expected +++ b/cpp/ql/test/library-tests/valuenumbering/GlobalValueNumbering/diff_ir_expr.expected @@ -1,142 +0,0 @@ -| test.cpp:5:3:5:13 | ... = ... | test.cpp:5:3:5:13 | ... = ... | AST only | -| test.cpp:6:3:6:13 | ... = ... | test.cpp:6:3:6:13 | ... = ... | AST only | -| test.cpp:7:3:7:7 | ... = ... | test.cpp:7:3:7:7 | ... = ... | AST only | -| test.cpp:10:16:10:16 | 1 | test.cpp:10:16:10:16 | 1 | AST only | -| test.cpp:16:3:16:24 | ... = ... | test.cpp:16:3:16:24 | ... = ... | AST only | -| test.cpp:17:3:17:24 | ... = ... | test.cpp:17:3:17:24 | ... = ... | AST only | -| test.cpp:18:3:18:7 | ... = ... | test.cpp:18:3:18:7 | ... = ... | AST only | -| test.cpp:21:16:21:16 | 2 | test.cpp:21:16:21:16 | 2 | AST only | -| test.cpp:29:3:29:3 | x | test.cpp:31:3:31:3 | x | IR only | -| test.cpp:29:3:29:24 | ... = ... | test.cpp:29:3:29:24 | ... = ... | AST only | -| test.cpp:30:3:30:17 | call to change_global02 | test.cpp:30:3:30:17 | call to change_global02 | AST only | -| test.cpp:31:3:31:3 | x | test.cpp:29:3:29:3 | x | IR only | -| test.cpp:31:3:31:24 | ... = ... | test.cpp:31:3:31:24 | ... = ... | AST only | -| test.cpp:32:3:32:7 | ... = ... | test.cpp:32:3:32:7 | ... = ... | AST only | -| test.cpp:35:16:35:16 | 3 | test.cpp:35:16:35:16 | 3 | AST only | -| test.cpp:43:3:43:3 | x | test.cpp:45:3:45:3 | x | IR only | -| test.cpp:43:3:43:24 | ... = ... | test.cpp:43:3:43:24 | ... = ... | AST only | -| test.cpp:43:7:43:24 | ... + ... | test.cpp:45:7:45:24 | ... + ... | IR only | -| test.cpp:43:7:43:24 | ... + ... | test.cpp:46:7:46:7 | x | IR only | -| test.cpp:43:17:43:24 | global03 | test.cpp:45:17:45:24 | global03 | IR only | -| test.cpp:44:3:44:5 | * ... | test.cpp:44:4:44:5 | p2 | IR only | -| test.cpp:44:3:44:9 | ... = ... | test.cpp:44:3:44:9 | ... = ... | AST only | -| test.cpp:44:4:44:5 | p2 | test.cpp:44:3:44:5 | * ... | IR only | -| test.cpp:44:9:44:9 | 0 | test.cpp:51:25:51:25 | 0 | AST only | -| test.cpp:44:9:44:9 | 0 | test.cpp:53:18:53:21 | (int)... | AST only | -| test.cpp:44:9:44:9 | 0 | test.cpp:56:39:56:42 | (int)... | AST only | -| test.cpp:44:9:44:9 | 0 | test.cpp:59:17:59:20 | (int)... | AST only | -| test.cpp:44:9:44:9 | 0 | test.cpp:88:12:88:12 | 0 | AST only | -| test.cpp:45:3:45:3 | x | test.cpp:43:3:43:3 | x | IR only | -| test.cpp:45:3:45:24 | ... = ... | test.cpp:45:3:45:24 | ... = ... | AST only | -| test.cpp:45:7:45:24 | ... + ... | test.cpp:43:7:43:24 | ... + ... | IR only | -| test.cpp:45:17:45:24 | global03 | test.cpp:43:17:43:24 | global03 | IR only | -| test.cpp:46:3:46:7 | ... = ... | test.cpp:46:3:46:7 | ... = ... | AST only | -| test.cpp:46:7:46:7 | x | test.cpp:43:7:43:24 | ... + ... | IR only | -| test.cpp:51:25:51:25 | 0 | test.cpp:44:9:44:9 | 0 | AST only | -| test.cpp:51:25:51:25 | 0 | test.cpp:53:18:53:21 | (int)... | AST only | -| test.cpp:51:25:51:25 | 0 | test.cpp:56:39:56:42 | (int)... | AST only | -| test.cpp:51:25:51:25 | 0 | test.cpp:59:17:59:20 | (int)... | AST only | -| test.cpp:51:25:51:25 | 0 | test.cpp:88:12:88:12 | 0 | AST only | -| test.cpp:51:25:51:25 | (unsigned int)... | test.cpp:51:25:51:25 | (unsigned int)... | AST only | -| test.cpp:53:10:53:13 | (int)... | test.cpp:53:10:53:13 | (int)... | AST only | -| test.cpp:53:10:53:13 | (int)... | test.cpp:56:21:56:24 | (int)... | AST only | -| test.cpp:53:18:53:21 | (int)... | test.cpp:44:9:44:9 | 0 | AST only | -| test.cpp:53:18:53:21 | (int)... | test.cpp:51:25:51:25 | 0 | AST only | -| test.cpp:53:18:53:21 | (int)... | test.cpp:53:18:53:21 | (int)... | AST only | -| test.cpp:53:18:53:21 | (int)... | test.cpp:56:39:56:42 | (int)... | AST only | -| test.cpp:53:18:53:21 | (int)... | test.cpp:59:17:59:20 | (int)... | AST only | -| test.cpp:53:18:53:21 | (int)... | test.cpp:88:12:88:12 | 0 | AST only | -| test.cpp:55:5:55:15 | ... = ... | test.cpp:55:5:55:15 | ... = ... | AST only | -| test.cpp:56:12:56:25 | (...) | test.cpp:56:12:56:25 | (...) | AST only | -| test.cpp:56:12:56:43 | ... && ... | test.cpp:56:12:56:43 | ... && ... | AST only | -| test.cpp:56:13:56:16 | (int)... | test.cpp:56:13:56:16 | (int)... | AST only | -| test.cpp:56:13:56:16 | (int)... | test.cpp:56:31:56:34 | (int)... | AST only | -| test.cpp:56:13:56:16 | (int)... | test.cpp:59:9:59:12 | (int)... | AST only | -| test.cpp:56:13:56:16 | * ... | test.cpp:56:31:56:34 | * ... | AST only | -| test.cpp:56:13:56:16 | * ... | test.cpp:59:9:59:12 | * ... | AST only | -| test.cpp:56:21:56:24 | (int)... | test.cpp:53:10:53:13 | (int)... | AST only | -| test.cpp:56:21:56:24 | (int)... | test.cpp:56:21:56:24 | (int)... | AST only | -| test.cpp:56:30:56:43 | (...) | test.cpp:56:30:56:43 | (...) | AST only | -| test.cpp:56:31:56:34 | (int)... | test.cpp:56:13:56:16 | (int)... | AST only | -| test.cpp:56:31:56:34 | (int)... | test.cpp:56:31:56:34 | (int)... | AST only | -| test.cpp:56:31:56:34 | (int)... | test.cpp:59:9:59:12 | (int)... | AST only | -| test.cpp:56:31:56:34 | * ... | test.cpp:56:13:56:16 | * ... | AST only | -| test.cpp:56:31:56:34 | * ... | test.cpp:59:9:59:12 | * ... | AST only | -| test.cpp:56:39:56:42 | (int)... | test.cpp:44:9:44:9 | 0 | AST only | -| test.cpp:56:39:56:42 | (int)... | test.cpp:51:25:51:25 | 0 | AST only | -| test.cpp:56:39:56:42 | (int)... | test.cpp:53:18:53:21 | (int)... | AST only | -| test.cpp:56:39:56:42 | (int)... | test.cpp:56:39:56:42 | (int)... | AST only | -| test.cpp:56:39:56:42 | (int)... | test.cpp:59:17:59:20 | (int)... | AST only | -| test.cpp:56:39:56:42 | (int)... | test.cpp:88:12:88:12 | 0 | AST only | -| test.cpp:56:47:56:51 | ... ++ | test.cpp:56:47:56:51 | ... ++ | AST only | -| test.cpp:59:9:59:12 | (int)... | test.cpp:56:13:56:16 | (int)... | AST only | -| test.cpp:59:9:59:12 | (int)... | test.cpp:56:31:56:34 | (int)... | AST only | -| test.cpp:59:9:59:12 | (int)... | test.cpp:59:9:59:12 | (int)... | AST only | -| test.cpp:59:9:59:12 | * ... | test.cpp:56:13:56:16 | * ... | AST only | -| test.cpp:59:9:59:12 | * ... | test.cpp:56:31:56:34 | * ... | AST only | -| test.cpp:59:17:59:20 | (int)... | test.cpp:44:9:44:9 | 0 | AST only | -| test.cpp:59:17:59:20 | (int)... | test.cpp:51:25:51:25 | 0 | AST only | -| test.cpp:59:17:59:20 | (int)... | test.cpp:53:18:53:21 | (int)... | AST only | -| test.cpp:59:17:59:20 | (int)... | test.cpp:56:39:56:42 | (int)... | AST only | -| test.cpp:59:17:59:20 | (int)... | test.cpp:59:17:59:20 | (int)... | AST only | -| test.cpp:59:17:59:20 | (int)... | test.cpp:88:12:88:12 | 0 | AST only | -| test.cpp:62:5:62:12 | ... ++ | test.cpp:62:5:62:12 | ... ++ | AST only | -| test.cpp:77:20:77:28 | call to getAValue | test.cpp:79:7:79:7 | v | IR only | -| test.cpp:77:20:77:30 | (signed short)... | test.cpp:77:20:77:30 | (signed short)... | AST only | -| test.cpp:77:20:77:30 | (signed short)... | test.cpp:79:7:79:7 | v | AST only | -| test.cpp:79:7:79:7 | (int)... | test.cpp:79:7:79:7 | (int)... | AST only | -| test.cpp:79:7:79:7 | v | test.cpp:77:20:77:28 | call to getAValue | IR only | -| test.cpp:79:7:79:7 | v | test.cpp:77:20:77:30 | (signed short)... | AST only | -| test.cpp:79:11:79:20 | (int)... | test.cpp:79:11:79:20 | (int)... | AST only | -| test.cpp:79:24:79:33 | (int)... | test.cpp:79:24:79:33 | (int)... | AST only | -| test.cpp:80:5:80:19 | ... = ... | test.cpp:80:5:80:19 | ... = ... | AST only | -| test.cpp:80:9:80:19 | (signed short)... | test.cpp:80:9:80:19 | (signed short)... | AST only | -| test.cpp:88:3:88:20 | ... = ... | test.cpp:88:3:88:20 | ... = ... | AST only | -| test.cpp:88:12:88:12 | 0 | test.cpp:44:9:44:9 | 0 | AST only | -| test.cpp:88:12:88:12 | 0 | test.cpp:51:25:51:25 | 0 | AST only | -| test.cpp:88:12:88:12 | 0 | test.cpp:53:18:53:21 | (int)... | AST only | -| test.cpp:88:12:88:12 | 0 | test.cpp:56:39:56:42 | (int)... | AST only | -| test.cpp:88:12:88:12 | 0 | test.cpp:59:17:59:20 | (int)... | AST only | -| test.cpp:88:12:88:12 | (void *)... | test.cpp:88:12:88:12 | (void *)... | AST only | -| test.cpp:92:11:92:16 | ... = ... | test.cpp:92:15:92:16 | 10 | IR only | -| test.cpp:92:11:92:16 | ... = ... | test.cpp:93:10:93:10 | x | IR only | -| test.cpp:92:15:92:16 | 10 | test.cpp:92:11:92:16 | ... = ... | IR only | -| test.cpp:92:15:92:16 | 10 | test.cpp:93:10:93:10 | x | IR only | -| test.cpp:93:10:93:10 | x | test.cpp:92:11:92:16 | ... = ... | IR only | -| test.cpp:93:10:93:10 | x | test.cpp:92:15:92:16 | 10 | IR only | -| test.cpp:105:11:105:12 | (Base *)... | test.cpp:105:11:105:12 | (Base *)... | AST only | -| test.cpp:105:11:105:12 | (Base *)... | test.cpp:106:14:106:35 | static_cast... | AST only | -| test.cpp:105:11:105:12 | (Base *)... | test.cpp:107:11:107:12 | pb | AST only | -| test.cpp:105:11:105:12 | pd | test.cpp:107:11:107:12 | pb | IR only | -| test.cpp:106:14:106:35 | static_cast... | test.cpp:105:11:105:12 | (Base *)... | AST only | -| test.cpp:106:14:106:35 | static_cast... | test.cpp:106:14:106:35 | static_cast... | AST only | -| test.cpp:106:14:106:35 | static_cast... | test.cpp:107:11:107:12 | pb | AST only | -| test.cpp:106:33:106:34 | pd | test.cpp:107:11:107:12 | pb | IR only | -| test.cpp:107:11:107:12 | pb | test.cpp:105:11:105:12 | (Base *)... | AST only | -| test.cpp:107:11:107:12 | pb | test.cpp:105:11:105:12 | pd | IR only | -| test.cpp:107:11:107:12 | pb | test.cpp:106:14:106:35 | static_cast... | AST only | -| test.cpp:107:11:107:12 | pb | test.cpp:106:33:106:34 | pd | IR only | -| test.cpp:113:3:113:5 | a | test.cpp:115:3:115:5 | a | IR only | -| test.cpp:115:3:115:5 | a | test.cpp:113:3:113:5 | a | IR only | -| test.cpp:125:15:125:15 | x | test.cpp:128:7:128:7 | x | AST only | -| test.cpp:126:15:126:15 | x | test.cpp:128:7:128:7 | x | AST only | -| test.cpp:128:3:128:11 | ... = ... | test.cpp:128:3:128:11 | ... = ... | AST only | -| test.cpp:128:7:128:7 | x | test.cpp:125:15:125:15 | x | AST only | -| test.cpp:128:7:128:7 | x | test.cpp:126:15:126:15 | x | AST only | -| test.cpp:128:11:128:11 | n | test.cpp:129:15:129:15 | x | IR only | -| test.cpp:129:15:129:15 | x | test.cpp:128:11:128:11 | n | IR only | -| test.cpp:136:21:136:21 | x | test.cpp:137:21:137:21 | x | AST only | -| test.cpp:136:21:136:21 | x | test.cpp:139:13:139:13 | x | AST only | -| test.cpp:137:21:137:21 | x | test.cpp:136:21:136:21 | x | AST only | -| test.cpp:137:21:137:21 | x | test.cpp:139:13:139:13 | x | AST only | -| test.cpp:139:3:139:24 | ... = ... | test.cpp:139:3:139:24 | ... = ... | AST only | -| test.cpp:139:13:139:13 | x | test.cpp:136:21:136:21 | x | AST only | -| test.cpp:139:13:139:13 | x | test.cpp:137:21:137:21 | x | AST only | -| test.cpp:144:15:144:15 | x | test.cpp:149:15:149:15 | x | IR only | -| test.cpp:145:15:145:15 | y | test.cpp:147:7:147:7 | y | AST only | -| test.cpp:147:3:147:18 | ... = ... | test.cpp:147:3:147:18 | ... = ... | AST only | -| test.cpp:147:7:147:7 | y | test.cpp:145:15:145:15 | y | AST only | -| test.cpp:149:15:149:15 | x | test.cpp:144:15:144:15 | x | IR only | -| test.cpp:153:21:153:21 | x | test.cpp:154:21:154:21 | x | AST only | -| test.cpp:154:21:154:21 | x | test.cpp:153:21:153:21 | x | AST only | -| test.cpp:156:3:156:17 | ... = ... | test.cpp:156:3:156:17 | ... = ... | AST only | diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/StrncpyFlippedArgs.expected b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/StrncpyFlippedArgs.expected index c9827bd83e11..0fe37d1fe056 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/StrncpyFlippedArgs.expected +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/StrncpyFlippedArgs/StrncpyFlippedArgs.expected @@ -12,6 +12,5 @@ | test.cpp:46:2:46:9 | call to strcpy_s | Potentially unsafe call to strcpy_s; second argument should be size of destination. | | test.cpp:47:2:47:9 | call to strcpy_s | Potentially unsafe call to strcpy_s; second argument should be size of destination. | | test.cpp:60:3:60:9 | call to strncpy | Potentially unsafe call to strncpy; third argument should be size of destination. | -| test.cpp:63:3:63:9 | call to strncpy | Potentially unsafe call to strncpy; third argument should be size of destination. | +| test.cpp:68:2:68:8 | call to strncpy | Potentially unsafe call to strncpy; third argument should be size of destination. | | test.cpp:79:3:79:9 | call to strncpy | Potentially unsafe call to strncpy; third argument should be size of destination. | -| test.cpp:82:3:82:9 | call to strncpy | Potentially unsafe call to strncpy; third argument should be size of destination. | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected index 5096e75ebc32..11a042a6768d 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-120/semmle/tests/UnboundedWrite.expected @@ -1,5 +1,10 @@ | tests.c:28:3:28:9 | call to sprintf | This 'call to sprintf' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv | | tests.c:29:3:29:9 | call to sprintf | This 'call to sprintf' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv | +| tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv | +| tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv | | tests.c:31:15:31:23 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:31:15:31:23 | buffer100 | buffer100 | +| tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:28:22:28:25 | argv | argv | +| tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:29:28:29:31 | argv | argv | +| tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:31:15:31:23 | buffer100 | buffer100 | | tests.c:33:21:33:29 | buffer100 | This 'scanf string argument' with input from $@ may overflow the destination. | tests.c:33:21:33:29 | buffer100 | buffer100 | | tests.c:34:25:34:33 | buffer100 | This 'sscanf string argument' with input from $@ may overflow the destination. | tests.c:34:10:34:13 | argv | argv | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.expected index 829b4a234cf5..8efbc165c86c 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-129/semmle/ImproperArrayIndexValidation/ImproperArrayIndexValidation.expected @@ -1,4 +1,3 @@ | test1.c:18:16:18:16 | i | $@ flows to here and is used in an array indexing expression, potentially causing an invalid access. | test1.c:8:16:8:19 | argv | User-provided value | | test1.c:33:11:33:11 | i | $@ flows to here and is used in an array indexing expression, potentially causing an invalid access. | test1.c:8:16:8:19 | argv | User-provided value | -| test1.c:37:11:37:11 | i | $@ flows to here and is used in an array indexing expression, potentially causing an invalid access. | test1.c:8:16:8:19 | argv | User-provided value | | test1.c:53:15:53:15 | j | $@ flows to here and is used in an array indexing expression, potentially causing an invalid access. | test1.c:8:16:8:19 | argv | User-provided value | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected index 1946adcb6594..ea24f969f34f 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/argv/argvLocal.expected @@ -16,15 +16,7 @@ | argvLocal.c:132:15:132:20 | ... + ... | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:126:10:126:13 | argv | argv | | argvLocal.c:135:9:135:12 | ... ++ | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:115:13:115:16 | argv | argv | | argvLocal.c:136:15:136:18 | -- ... | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:115:13:115:16 | argv | argv | -| argvLocal.c:139:9:139:26 | ... ? ... : ... | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:126:10:126:13 | argv | argv | -| argvLocal.c:140:15:140:32 | ... ? ... : ... | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:126:10:126:13 | argv | argv | | argvLocal.c:144:9:144:10 | i7 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:100:7:100:10 | argv | argv | | argvLocal.c:145:15:145:16 | i7 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:100:7:100:10 | argv | argv | -| argvLocal.c:150:9:150:10 | i8 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:149:15:149:18 | argv | argv | -| argvLocal.c:151:15:151:16 | i8 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:149:15:149:18 | argv | argv | -| argvLocal.c:156:9:156:10 | i9 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:155:23:155:26 | argv | argv | -| argvLocal.c:157:15:157:16 | i9 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:155:23:155:26 | argv | argv | -| argvLocal.c:162:9:162:11 | i91 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:161:42:161:45 | argv | argv | -| argvLocal.c:163:15:163:17 | i91 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:161:42:161:45 | argv | argv | | argvLocal.c:167:18:167:20 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | argvLocal.c:166:18:166:21 | argv | argv | | argvLocal.c:168:24:168:26 | i10 | The value of this argument may come from $@ and is being used as a formatting argument to printWrapper(correct), which calls printf(format) | argvLocal.c:166:18:166:21 | argv | argv | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected index 06d4329385fb..3b73052432d3 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/funcs/funcsLocal.expected @@ -3,6 +3,3 @@ | funcsLocal.c:32:9:32:10 | i4 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:31:13:31:17 | call to fgets | fgets | | funcsLocal.c:37:9:37:10 | i5 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:36:7:36:8 | i5 | gets | | funcsLocal.c:42:9:42:10 | i6 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:41:13:41:16 | call to gets | gets | -| funcsLocal.c:47:9:47:11 | * ... | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:46:7:46:9 | * ... | gets | -| funcsLocal.c:53:9:53:11 | * ... | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:52:8:52:11 | call to gets | gets | -| funcsLocal.c:58:9:58:10 | e1 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | funcsLocal.c:16:8:16:9 | i1 | fread | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected index 1ac14a1578e3..d474364a0cc7 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-134/semmle/ifs/ifs.expected @@ -1,3 +1,4 @@ +| ifs.c:62:9:62:10 | c7 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | ifs.c:61:8:61:11 | argv | argv | | ifs.c:69:9:69:10 | c8 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | ifs.c:68:8:68:11 | argv | argv | | ifs.c:75:9:75:10 | i1 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | ifs.c:74:8:74:11 | argv | argv | | ifs.c:81:9:81:10 | i2 | The value of this argument may come from $@ and is being used as a formatting argument to printf(format) | ifs.c:80:8:80:11 | argv | argv | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected index ec6ac0eade77..2463fad2e2b5 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected @@ -1,6 +1,8 @@ | test.cpp:42:31:42:36 | call to malloc | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | +| test.cpp:43:31:43:36 | call to malloc | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | | test.cpp:43:38:43:63 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | +| test.cpp:45:31:45:36 | call to malloc | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | | test.cpp:48:25:48:30 | call to malloc | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | | test.cpp:49:17:49:30 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | +| test.cpp:52:21:52:27 | call to realloc | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | | test.cpp:52:35:52:60 | ... * ... | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | -| test.cpp:55:11:55:24 | new[] | This allocation size is derived from $@ and might overflow | test.cpp:39:21:39:24 | argv | user input (argv) | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected index 73761672f77a..20e5eafbd3b6 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/extreme/ArithmeticWithExtremeValues.expected @@ -1,7 +1,6 @@ | test.c:17:10:17:12 | min | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:8:9:8:15 | 2147483647 | Extreme value | | test.c:48:3:48:5 | sc2 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:47:9:47:16 | - ... | Extreme value | | test.c:50:3:50:5 | sc3 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:49:9:49:16 | 127 | Extreme value | -| test.c:56:3:56:5 | sc5 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:54:9:54:16 | 127 | Extreme value | | test.c:59:3:59:5 | sc6 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:58:9:58:16 | 127 | Extreme value | | test.c:63:3:63:5 | sc8 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:62:9:62:16 | - ... | Extreme value | | test.c:75:3:75:5 | sc1 | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:74:9:74:16 | 127 | Extreme value | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected index d5bca37aa58e..594f572f25f0 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/uncontrolled/ArithmeticUncontrolled.expected @@ -8,4 +8,3 @@ | test.c:77:9:77:9 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:75:13:75:19 | ... ^ ... | Uncontrolled value | | test.c:100:5:100:5 | r | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:99:14:99:19 | call to rand | Uncontrolled value | | test.cpp:25:7:25:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:8:9:8:12 | call to rand | Uncontrolled value | -| test.cpp:37:7:37:7 | r | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.cpp:18:9:18:12 | call to rand | Uncontrolled value | diff --git a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected index 3c784a2cb0f5..0ae48831c803 100644 --- a/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-807/semmle/TaintedCondition/TaintedCondition.expected @@ -1 +1,2 @@ | test.cpp:24:10:24:35 | ! ... | Reliance on untrusted input $@ to raise privilege at $@ | test.cpp:20:29:20:34 | call to getenv | call to getenv | test.cpp:25:9:25:27 | ... = ... | ... = ... | +| test.cpp:41:10:41:38 | ! ... | Reliance on untrusted input $@ to raise privilege at $@ | test.cpp:20:29:20:34 | call to getenv | call to getenv | test.cpp:42:8:42:26 | ... = ... | ... = ... | From 0aba965a9e31b53afd01e68ceebab465e42868de Mon Sep 17 00:00:00 2001 From: Jonas Jensen Date: Sun, 16 Feb 2020 09:43:25 +0100 Subject: [PATCH 4/4] C++: Don't mention deprecated class The language tests were failing because they don't tolerate mentioning a deprecated class anywhere. --- .../src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll index 9bb447cc681a..b10997f3f182 100644 --- a/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll +++ b/cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll @@ -303,10 +303,12 @@ ParameterNode parameterNode(Parameter p) { result.getParameter() = p } VariableNode variableNode(Variable v) { result.getVariable() = v } /** + * DEPRECATED: See UninitializedNode. + * * Gets the `Node` corresponding to the value of an uninitialized local * variable `v`. */ -UninitializedNode uninitializedNode(LocalVariable v) { result.getLocalVariable() = v } +Node uninitializedNode(LocalVariable v) { none() } /** * Holds if data flows from `nodeFrom` to `nodeTo` in exactly one local