Skip to content

Commit 423e0bf

Browse files
author
Robert Marsh
committed
C++: respond to style comments on PR
1 parent f17b563 commit 423e0bf

2 files changed

Lines changed: 15 additions & 18 deletions

File tree

‎cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -63,14 +63,14 @@ predicate isInvalidPointerDerefSink(DataFlow::Node sink, Instruction i, string o
6363

6464
predicate isConstantSizeOverflowSource(Field f, PointerAddInstruction pai, int delta) {
6565
exists(
66-
int size, int bound, SemZeroBound b, FieldAddressToPointerArithmeticConf conf,
67-
DataFlow::Node source, DataFlow::InstructionNode sink
66+
int size, int bound, FieldAddressToPointerArithmeticConf conf, DataFlow::Node source,
67+
DataFlow::InstructionNode sink
6868
|
6969
conf.hasFlow(source, sink) and
7070
isFieldAddressSource(f, source) and
7171
pai.getLeft() = sink.asInstruction() and
7272
f.getUnspecifiedType().(ArrayType).getArraySize() = size and
73-
semBounded(getSemanticExpr(pai.getRight()), b, bound, true, _) and
73+
semBounded(getSemanticExpr(pai.getRight()), any(SemZeroBound b), bound, true, _) and
7474
delta = bound - size and
7575
delta >= 0 and
7676
size != 0 and
@@ -89,13 +89,12 @@ class PointerArithmeticToDerefConf extends DataFlow2::Configuration {
8989
}
9090

9191
from
92-
Field f, DataFlow::Node source, DataFlow::Node sink,
93-
Instruction deref,
92+
Field f, DataFlow::Node source, DataFlow::Node sink, Instruction deref,
9493
PointerArithmeticToDerefConf conf, string operation, int delta
9594
where
9695
conf.hasFlow(source, sink) and
9796
isInvalidPointerDerefSink(sink, deref, operation) and
9897
isConstantSizeOverflowSource(f, source.asInstruction(), delta)
9998
select source,
100-
"This pointer arithmetic may have an off-by-" + (delta + 1) + " error allowing it to overrun $@ at this $@",
101-
f, f.getName(), deref, operation
99+
"This pointer arithmetic may have an off-by-" + (delta + 1) +
100+
" error allowing it to overrun $@ at this $@.", f, f.getName(), deref, operation

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
1-
| test.cpp:26:5:26:15 | access to array | This pointer arithmetic may have an off-by-0 error allowing it to overrun $@ at this $@ | test.cpp:5:9:5:11 | buf | buf | test.cpp:26:5:26:19 | Store: ... = ... | write |
2-
| test.cpp:30:5:30:15 | access to array | This pointer arithmetic may have an off-by-0 error allowing it to overrun $@ at this $@ | test.cpp:10:9:10:11 | buf | buf | test.cpp:30:5:30:19 | Store: ... = ... | write |
3-
| test.cpp:35:5:35:22 | access to array | This pointer arithmetic may have an off-by-0 error allowing it to overrun $@ at this $@ | test.cpp:15:9:15:11 | buf | buf | test.cpp:35:5:35:26 | Store: ... = ... | write |
4-
| test.cpp:36:5:36:24 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@ | test.cpp:15:9:15:11 | buf | buf | test.cpp:36:5:36:28 | Store: ... = ... | write |
5-
| test.cpp:43:9:43:19 | access to array | This pointer arithmetic may have an off-by-0 error allowing it to overrun $@ at this $@ | test.cpp:15:9:15:11 | buf | buf | test.cpp:43:9:43:23 | Store: ... = ... | write |
6-
| test.cpp:49:5:49:22 | access to array | This pointer arithmetic may have an off-by-0 error allowing it to overrun $@ at this $@ | test.cpp:19:9:19:11 | buf | buf | test.cpp:49:5:49:26 | Store: ... = ... | write |
7-
| test.cpp:50:5:50:24 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@ | test.cpp:19:9:19:11 | buf | buf | test.cpp:50:5:50:28 | Store: ... = ... | write |
8-
| test.cpp:57:9:57:19 | access to array | This pointer arithmetic may have an off-by-0 error allowing it to overrun $@ at this $@ | test.cpp:19:9:19:11 | buf | buf | test.cpp:57:9:57:23 | Store: ... = ... | write |
9-
| test.cpp:61:9:61:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@ | test.cpp:19:9:19:11 | buf | buf | test.cpp:61:9:61:23 | Store: ... = ... | write |
10-
| test.cpp:72:5:72:15 | access to array | This pointer arithmetic may have an off-by-0 error allowing it to overrun $@ at this $@ | test.cpp:15:9:15:11 | buf | buf | test.cpp:72:5:72:19 | Store: ... = ... | write |
11-
| test.cpp:77:27:77:44 | access to array | This pointer arithmetic may have an off-by-0 error allowing it to overrun $@ at this $@ | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |
1+
| test.cpp:35:5:35:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:35:5:35:26 | Store: ... = ... | write |
2+
| test.cpp:36:5:36:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:36:5:36:28 | Store: ... = ... | write |
3+
| test.cpp:43:9:43:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:43:9:43:23 | Store: ... = ... | write |
4+
| test.cpp:49:5:49:22 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:49:5:49:26 | Store: ... = ... | write |
5+
| test.cpp:50:5:50:24 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:50:5:50:28 | Store: ... = ... | write |
6+
| test.cpp:57:9:57:19 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:57:9:57:23 | Store: ... = ... | write |
7+
| test.cpp:61:9:61:19 | access to array | This pointer arithmetic may have an off-by-2 error allowing it to overrun $@ at this $@. | test.cpp:19:9:19:11 | buf | buf | test.cpp:61:9:61:23 | Store: ... = ... | write |
8+
| test.cpp:72:5:72:15 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:72:5:72:19 | Store: ... = ... | write |
9+
| test.cpp:77:27:77:44 | access to array | This pointer arithmetic may have an off-by-1 error allowing it to overrun $@ at this $@. | test.cpp:15:9:15:11 | buf | buf | test.cpp:67:5:67:10 | Store: ... = ... | write |

0 commit comments

Comments
 (0)