зеркало из https://github.com/github/codeql.git
Merge pull request #15820 from MathiasVP/add-type-confusion-query
C++: Add a new query for detecting type confusion vulnerabilities
This commit is contained in:
Mathias Vorreiter Pedersen
GitHub
Коммит
1a42e55095
|
|
@ -0,0 +1,50 @@
|
|||
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
|
||||
<qhelp>
|
||||
|
||||
<overview>
|
||||
<p>
|
||||
Certain casts in C and C++ place no restrictions on the target type. For
|
||||
example, C style casts such as <code>(MyClass*)p</code> allows the programmer
|
||||
to cast any pointer <code>p</code> to an expression of type <code>MyClass*</code>.
|
||||
If the runtime type of <code>p</code> turns out to be a type that's incompatible
|
||||
with <code>MyClass</code>, this results in undefined behavior.
|
||||
</p>
|
||||
</overview>
|
||||
|
||||
<recommendation>
|
||||
<p>
|
||||
If possible, use <code>dynamic_cast</code> to safely cast between polymorphic types.
|
||||
If <code>dynamic_cast</code> is not an option, use <code>static_cast</code> to restrict
|
||||
the kinds of conversions that the compiler is allowed to perform. If C++ style casts is
|
||||
not an option, carefully check that all casts are safe.
|
||||
</p>
|
||||
</recommendation>
|
||||
|
||||
<example>
|
||||
<p>
|
||||
Consider the following class hierachy where we define a base class <code>Shape</code> and two
|
||||
derived classes <code>Circle</code> and <code>Square</code> that are mutually incompatible:
|
||||
</p>
|
||||
<sample src="TypeConfusionCommon.cpp"/>
|
||||
|
||||
<p>
|
||||
The following code demonstrates a type confusion vulnerability where the programmer
|
||||
assumes that the runtime type of <code>p</code> is always a <code>Square</code>.
|
||||
However, if <code>p</code> is a <code>Circle</code>, the cast will result in undefined behavior.
|
||||
</p>
|
||||
<sample src="TypeConfusionBad.cpp"/>
|
||||
|
||||
<p>
|
||||
The following code fixes the vulnerability by using <code>dynamic_cast</code> to
|
||||
safely cast between polymorphic types. If the cast fails, <code>dynamic_cast</code>
|
||||
returns a null pointer, which can be checked for and handled appropriately.
|
||||
</p>
|
||||
<sample src="TypeConfusionGood.cpp"/>
|
||||
</example>
|
||||
|
||||
<references>
|
||||
<li>
|
||||
Microsoft Learn: <a href="https://learn.microsoft.com/en-us/cpp/cpp/type-conversions-and-type-safety-modern-cpp">Type conversions and type safety</a>.
|
||||
</li>
|
||||
</references>
|
||||
</qhelp>
|
||||
|
|
@ -0,0 +1,263 @@
|
|||
/**
|
||||
* @name Type confusion
|
||||
* @description Casting a value to an incompatible type can lead to undefined behavior.
|
||||
* @kind path-problem
|
||||
* @problem.severity warning
|
||||
* @security-severity 9.3
|
||||
* @precision medium
|
||||
* @id cpp/type-confusion
|
||||
* @tags security
|
||||
* external/cwe/cwe-843
|
||||
*/
|
||||
|
||||
import cpp
|
||||
import semmle.code.cpp.dataflow.new.DataFlow
|
||||
import Flow::PathGraph
|
||||
|
||||
/**
|
||||
* Holds if `f` is a field located at byte offset `offset` in `c`.
|
||||
*
|
||||
* Note that predicate is recursive, so that given the following:
|
||||
* ```cpp
|
||||
* struct S1 {
|
||||
* int a;
|
||||
* void* b;
|
||||
* };
|
||||
*
|
||||
* struct S2 {
|
||||
* S1 s1;
|
||||
* char c;
|
||||
* };
|
||||
* ```
|
||||
* both `hasAFieldWithOffset(S2, s1, 0)` and `hasAFieldWithOffset(S2, a, 0)`
|
||||
* holds.
|
||||
*/
|
||||
predicate hasAFieldWithOffset(Class c, Field f, int offset) {
|
||||
// Base case: `f` is a field in `c`.
|
||||
f = c.getAField() and
|
||||
offset = f.getByteOffset() and
|
||||
not f.getUnspecifiedType().(Class).hasDefinition()
|
||||
or
|
||||
// Otherwise, we find the struct that is a field of `c` which then has
|
||||
// the field `f` as a member.
|
||||
exists(Field g |
|
||||
g = c.getAField() and
|
||||
// Find the field with the largest offset that's less than or equal to
|
||||
// offset. That's the struct we need to search recursively.
|
||||
g =
|
||||
max(Field cand, int candOffset |
|
||||
cand = c.getAField() and
|
||||
candOffset = cand.getByteOffset() and
|
||||
offset >= candOffset
|
||||
|
|
||||
cand order by candOffset
|
||||
) and
|
||||
hasAFieldWithOffset(g.getUnspecifiedType(), f, offset - g.getByteOffset())
|
||||
)
|
||||
}
|
||||
|
||||
/** Holds if `f` is the last field of its declaring class. */
|
||||
predicate lastField(Field f) {
|
||||
exists(Class c | c = f.getDeclaringType() |
|
||||
f =
|
||||
max(Field cand, int byteOffset |
|
||||
cand.getDeclaringType() = c and byteOffset = f.getByteOffset()
|
||||
|
|
||||
cand order by byteOffset
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if there exists a field in `c2` at offset `offset` that's compatible
|
||||
* with `f1`.
|
||||
*/
|
||||
bindingset[f1, offset, c2]
|
||||
pragma[inline_late]
|
||||
predicate hasCompatibleFieldAtOffset(Field f1, int offset, Class c2) {
|
||||
exists(Field f2 | hasAFieldWithOffset(c2, f2, offset) |
|
||||
// Let's not deal with bit-fields for now.
|
||||
f2 instanceof BitField
|
||||
or
|
||||
f1.getUnspecifiedType().getSize() = f2.getUnspecifiedType().getSize()
|
||||
or
|
||||
lastField(f1) and
|
||||
f1.getUnspecifiedType().getSize() <= f2.getUnspecifiedType().getSize()
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `c1` is a prefix of `c2`.
|
||||
*/
|
||||
bindingset[c1, c2]
|
||||
pragma[inline_late]
|
||||
predicate prefix(Class c1, Class c2) {
|
||||
not c1.isPolymorphic() and
|
||||
not c2.isPolymorphic() and
|
||||
if c1 instanceof Union
|
||||
then
|
||||
// If it's a union we just verify that one of it's variants is compatible with the other class
|
||||
exists(Field f1, int offset |
|
||||
// Let's not deal with bit-fields for now.
|
||||
not f1 instanceof BitField and
|
||||
hasAFieldWithOffset(c1, f1, offset)
|
||||
|
|
||||
hasCompatibleFieldAtOffset(f1, offset, c2)
|
||||
)
|
||||
else
|
||||
forall(Field f1, int offset |
|
||||
// Let's not deal with bit-fields for now.
|
||||
not f1 instanceof BitField and
|
||||
hasAFieldWithOffset(c1, f1, offset)
|
||||
|
|
||||
hasCompatibleFieldAtOffset(f1, offset, c2)
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* An unsafe cast is any explicit cast that is not
|
||||
* a `dynamic_cast`.
|
||||
*/
|
||||
class UnsafeCast extends Cast {
|
||||
private Class toType;
|
||||
|
||||
UnsafeCast() {
|
||||
(
|
||||
this instanceof CStyleCast
|
||||
or
|
||||
this instanceof StaticCast
|
||||
or
|
||||
this instanceof ReinterpretCast
|
||||
) and
|
||||
toType = this.getExplicitlyConverted().getUnspecifiedType().stripType() and
|
||||
not this.isImplicit() and
|
||||
exists(TypeDeclarationEntry tde |
|
||||
tde = toType.getDefinition() and
|
||||
not tde.isFromUninstantiatedTemplate(_)
|
||||
)
|
||||
}
|
||||
|
||||
Class getConvertedType() { result = toType }
|
||||
|
||||
/**
|
||||
* Holds if the result of this cast can safely be interpreted as a value of
|
||||
* type `t`.
|
||||
*
|
||||
* The compatibility rules are as follows:
|
||||
*
|
||||
* 1. the result of `(T)x` is compatible with the type `T` for any `T`
|
||||
* 2. the result of `(T)x` is compatible with the type `U` for any `U` such
|
||||
* that `U` is a subtype of `T`, or `T` is a subtype of `U`.
|
||||
* 3. the result of `(T)x` is compatible with the type `U` if the list
|
||||
* of fields of `T` is a prefix of the list of fields of `U`.
|
||||
* For example, if `U` is `struct { unsigned char x; int y; };`
|
||||
* and `T` is `struct { unsigned char uc; };`.
|
||||
* 4. the result of `(T)x` is compatible with the type `U` if the list
|
||||
* of fields of `U` is a prefix of the list of fields of `T`.
|
||||
*
|
||||
* Condition 4 is a bit controversial, since it assumes that the additional
|
||||
* fields in `T` won't be accessed. This may result in some FNs.
|
||||
*/
|
||||
bindingset[this, t]
|
||||
pragma[inline_late]
|
||||
predicate compatibleWith(Type t) {
|
||||
// Conition 1
|
||||
t.stripType() = this.getConvertedType()
|
||||
or
|
||||
// Condition 3
|
||||
prefix(this.getConvertedType(), t.stripType())
|
||||
or
|
||||
// Condition 4
|
||||
prefix(t.stripType(), this.getConvertedType())
|
||||
or
|
||||
// Condition 2 (a)
|
||||
t.stripType().(Class).getABaseClass+() = this.getConvertedType()
|
||||
or
|
||||
// Condition 2 (b)
|
||||
t.stripType() = this.getConvertedType().getABaseClass+()
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Holds if `source` is an allocation that allocates a value of type `type`.
|
||||
*/
|
||||
predicate isSourceImpl(DataFlow::Node source, Class type) {
|
||||
exists(AllocationExpr alloc |
|
||||
alloc = source.asExpr() and
|
||||
type = alloc.getAllocatedElementType().stripType() and
|
||||
not exists(
|
||||
alloc
|
||||
.(NewOrNewArrayExpr)
|
||||
.getAllocator()
|
||||
.(OperatorNewAllocationFunction)
|
||||
.getPlacementArgument()
|
||||
)
|
||||
) and
|
||||
exists(TypeDeclarationEntry tde |
|
||||
tde = type.getDefinition() and
|
||||
not tde.isFromUninstantiatedTemplate(_)
|
||||
)
|
||||
}
|
||||
|
||||
/** A configuration describing flow from an allocation to a potentially unsafe cast. */
|
||||
module Config implements DataFlow::ConfigSig {
|
||||
predicate isSource(DataFlow::Node source) { isSourceImpl(source, _) }
|
||||
|
||||
predicate isBarrier(DataFlow::Node node) {
|
||||
// We disable flow through global variables to reduce FPs from infeasible paths
|
||||
node instanceof DataFlow::VariableNode
|
||||
or
|
||||
exists(Class c | c = node.getType().stripType() |
|
||||
not c.hasDefinition()
|
||||
or
|
||||
exists(TypeDeclarationEntry tde |
|
||||
tde = c.getDefinition() and
|
||||
tde.isFromUninstantiatedTemplate(_)
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(UnsafeCast cast).getUnconverted() }
|
||||
|
||||
int fieldFlowBranchLimit() { result = 0 }
|
||||
}
|
||||
|
||||
module Flow = DataFlow::Global<Config>;
|
||||
|
||||
predicate relevantType(DataFlow::Node sink, Class allocatedType) {
|
||||
exists(DataFlow::Node source |
|
||||
Flow::flow(source, sink) and
|
||||
isSourceImpl(source, allocatedType)
|
||||
)
|
||||
}
|
||||
|
||||
predicate isSinkImpl(
|
||||
DataFlow::Node sink, Class allocatedType, Type convertedType, boolean compatible
|
||||
) {
|
||||
exists(UnsafeCast cast |
|
||||
relevantType(sink, allocatedType) and
|
||||
sink.asExpr() = cast.getUnconverted() and
|
||||
convertedType = cast.getConvertedType()
|
||||
|
|
||||
if cast.compatibleWith(allocatedType) then compatible = true else compatible = false
|
||||
)
|
||||
}
|
||||
|
||||
from
|
||||
Flow::PathNode source, Flow::PathNode sink, Type badSourceType, Type sinkType,
|
||||
DataFlow::Node sinkNode
|
||||
where
|
||||
Flow::flowPath(source, sink) and
|
||||
sinkNode = sink.getNode() and
|
||||
isSourceImpl(source.getNode(), badSourceType) and
|
||||
isSinkImpl(sinkNode, badSourceType, sinkType, false) and
|
||||
// If there is any flow that would result in a valid cast then we don't
|
||||
// report an alert here. This reduces the number of FPs from infeasible paths
|
||||
// significantly.
|
||||
not exists(DataFlow::Node goodSource, Type goodSourceType |
|
||||
isSourceImpl(goodSource, goodSourceType) and
|
||||
isSinkImpl(sinkNode, goodSourceType, sinkType, true) and
|
||||
Flow::flow(goodSource, sinkNode)
|
||||
)
|
||||
select sinkNode, source, sink, "Conversion from $@ to $@ is invalid.", badSourceType,
|
||||
badSourceType.toString(), sinkType, sinkType.toString()
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
void allocate_and_draw_bad() {
|
||||
Shape* shape = new Circle;
|
||||
// ...
|
||||
// BAD: Assumes that shape is always a Square
|
||||
Square* square = static_cast<Square*>(shape);
|
||||
int length = square->getLength();
|
||||
}
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
struct Shape {
|
||||
virtual ~Shape();
|
||||
|
||||
virtual void draw() = 0;
|
||||
};
|
||||
|
||||
struct Circle : public Shape {
|
||||
Circle();
|
||||
|
||||
void draw() override {
|
||||
/* ... */
|
||||
}
|
||||
|
||||
int getRadius();
|
||||
};
|
||||
|
||||
struct Square : public Shape {
|
||||
Square();
|
||||
|
||||
void draw() override {
|
||||
/* ... */
|
||||
}
|
||||
|
||||
int getLength();
|
||||
};
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
void allocate_and_draw_good() {
|
||||
Shape* shape = new Circle;
|
||||
// ...
|
||||
// GOOD: Dynamically checks if shape is a Square
|
||||
Square* square = dynamic_cast<Square*>(shape);
|
||||
if(square) {
|
||||
int length = square->getLength();
|
||||
} else {
|
||||
// handle error
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
---
|
||||
category: newQuery
|
||||
---
|
||||
* Added a new query, `cpp/type-confusion`, to detect casts to invalid types.
|
||||
|
|
@ -0,0 +1,74 @@
|
|||
edges
|
||||
| test.cpp:17:13:17:18 | new | test.cpp:18:21:18:47 | p | provenance | |
|
||||
| test.cpp:22:13:22:26 | new | test.cpp:23:12:23:30 | p | provenance | |
|
||||
| test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | provenance | |
|
||||
| test.cpp:32:13:32:30 | new | test.cpp:33:12:33:30 | p | provenance | |
|
||||
| test.cpp:47:21:47:36 | new | test.cpp:48:22:48:55 | p | provenance | |
|
||||
| test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | provenance | |
|
||||
| test.cpp:76:15:76:21 | new | test.cpp:77:12:77:31 | a | provenance | |
|
||||
| test.cpp:83:9:83:15 | new | test.cpp:88:14:88:33 | a | provenance | |
|
||||
| test.cpp:85:9:85:15 | new | test.cpp:88:14:88:33 | a | provenance | |
|
||||
| test.cpp:115:12:115:17 | new | test.cpp:116:20:116:51 | s2 | provenance | |
|
||||
| test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | provenance | |
|
||||
| test.cpp:140:12:140:17 | new | test.cpp:141:23:141:57 | s1 | provenance | |
|
||||
| test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | provenance | |
|
||||
| test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | provenance | |
|
||||
| test.cpp:166:9:166:15 | new | test.cpp:171:14:171:33 | a | provenance | |
|
||||
| test.cpp:168:9:168:15 | new | test.cpp:171:14:171:33 | a | provenance | |
|
||||
| test.cpp:179:15:179:24 | new | test.cpp:181:15:181:25 | u64 | provenance | |
|
||||
| test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | provenance | |
|
||||
| test.cpp:207:14:207:26 | new | test.cpp:209:17:209:28 | si | provenance | |
|
||||
| test.cpp:217:13:217:18 | new | test.cpp:218:30:218:65 | p | provenance | |
|
||||
| test.cpp:226:13:226:18 | new | test.cpp:227:29:227:63 | p | provenance | |
|
||||
nodes
|
||||
| test.cpp:17:13:17:18 | new | semmle.label | new |
|
||||
| test.cpp:18:21:18:47 | p | semmle.label | p |
|
||||
| test.cpp:22:13:22:26 | new | semmle.label | new |
|
||||
| test.cpp:23:12:23:30 | p | semmle.label | p |
|
||||
| test.cpp:27:13:27:18 | new | semmle.label | new |
|
||||
| test.cpp:28:25:28:55 | p | semmle.label | p |
|
||||
| test.cpp:32:13:32:30 | new | semmle.label | new |
|
||||
| test.cpp:33:12:33:30 | p | semmle.label | p |
|
||||
| test.cpp:47:21:47:36 | new | semmle.label | new |
|
||||
| test.cpp:48:22:48:55 | p | semmle.label | p |
|
||||
| test.cpp:66:15:66:21 | new | semmle.label | new |
|
||||
| test.cpp:67:12:67:31 | a | semmle.label | a |
|
||||
| test.cpp:76:15:76:21 | new | semmle.label | new |
|
||||
| test.cpp:77:12:77:31 | a | semmle.label | a |
|
||||
| test.cpp:83:9:83:15 | new | semmle.label | new |
|
||||
| test.cpp:85:9:85:15 | new | semmle.label | new |
|
||||
| test.cpp:88:14:88:33 | a | semmle.label | a |
|
||||
| test.cpp:115:12:115:17 | new | semmle.label | new |
|
||||
| test.cpp:116:20:116:51 | s2 | semmle.label | s2 |
|
||||
| test.cpp:127:12:127:17 | new | semmle.label | new |
|
||||
| test.cpp:128:24:128:59 | s2 | semmle.label | s2 |
|
||||
| test.cpp:140:12:140:17 | new | semmle.label | new |
|
||||
| test.cpp:141:23:141:57 | s1 | semmle.label | s1 |
|
||||
| test.cpp:143:14:143:19 | new | semmle.label | new |
|
||||
| test.cpp:145:28:145:68 | s1_2 | semmle.label | s1_2 |
|
||||
| test.cpp:153:9:153:15 | new | semmle.label | new |
|
||||
| test.cpp:159:14:159:33 | a | semmle.label | a |
|
||||
| test.cpp:166:9:166:15 | new | semmle.label | new |
|
||||
| test.cpp:168:9:168:15 | new | semmle.label | new |
|
||||
| test.cpp:171:14:171:33 | a | semmle.label | a |
|
||||
| test.cpp:179:15:179:24 | new | semmle.label | new |
|
||||
| test.cpp:181:15:181:25 | u64 | semmle.label | u64 |
|
||||
| test.cpp:187:15:187:24 | new | semmle.label | new |
|
||||
| test.cpp:189:25:189:45 | u64 | semmle.label | u64 |
|
||||
| test.cpp:207:14:207:26 | new | semmle.label | new |
|
||||
| test.cpp:209:17:209:28 | si | semmle.label | si |
|
||||
| test.cpp:217:13:217:18 | new | semmle.label | new |
|
||||
| test.cpp:218:30:218:65 | p | semmle.label | p |
|
||||
| test.cpp:226:13:226:18 | new | semmle.label | new |
|
||||
| test.cpp:227:29:227:63 | p | semmle.label | p |
|
||||
subpaths
|
||||
#select
|
||||
| test.cpp:28:25:28:55 | p | test.cpp:27:13:27:18 | new | test.cpp:28:25:28:55 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper |
|
||||
| test.cpp:33:12:33:30 | p | test.cpp:32:13:32:30 | new | test.cpp:33:12:33:30 | p | Conversion from $@ to $@ is invalid. | test.cpp:11:8:11:21 | Not_S1_wrapper | Not_S1_wrapper | test.cpp:1:8:1:9 | S1 | S1 |
|
||||
| test.cpp:67:12:67:31 | a | test.cpp:66:15:66:21 | new | test.cpp:67:12:67:31 | a | Conversion from $@ to $@ is invalid. | test.cpp:55:8:55:10 | Cat | Cat | test.cpp:60:8:60:10 | Dog | Dog |
|
||||
| test.cpp:128:24:128:59 | s2 | test.cpp:127:12:127:17 | new | test.cpp:128:24:128:59 | s2 | Conversion from $@ to $@ is invalid. | test.cpp:102:8:102:9 | S2 | S2 | test.cpp:119:8:119:20 | Not_S2_prefix | Not_S2_prefix |
|
||||
| test.cpp:145:28:145:68 | s1_2 | test.cpp:143:14:143:19 | new | test.cpp:145:28:145:68 | s1_2 | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:131:8:131:23 | HasSomeBitFields | HasSomeBitFields |
|
||||
| test.cpp:159:14:159:33 | a | test.cpp:153:9:153:15 | new | test.cpp:159:14:159:33 | a | Conversion from $@ to $@ is invalid. | test.cpp:60:8:60:10 | Dog | Dog | test.cpp:55:8:55:10 | Cat | Cat |
|
||||
| test.cpp:189:25:189:45 | u64 | test.cpp:187:15:187:24 | new | test.cpp:189:25:189:45 | u64 | Conversion from $@ to $@ is invalid. | test.cpp:175:8:175:13 | UInt64 | UInt64 | test.cpp:184:8:184:22 | UInt8_with_more | UInt8_with_more |
|
||||
| test.cpp:218:30:218:65 | p | test.cpp:217:13:217:18 | new | test.cpp:218:30:218:65 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:212:8:212:26 | UnrelatedStructSize | UnrelatedStructSize |
|
||||
| test.cpp:227:29:227:63 | p | test.cpp:226:13:226:18 | new | test.cpp:227:29:227:63 | p | Conversion from $@ to $@ is invalid. | test.cpp:1:8:1:9 | S1 | S1 | test.cpp:221:8:221:25 | TooLargeBufferSize | TooLargeBufferSize |
|
||||
|
|
@ -0,0 +1 @@
|
|||
Security/CWE/CWE-843/TypeConfusion.ql
|
||||
|
|
@ -0,0 +1,230 @@
|
|||
struct S1 {
|
||||
int a;
|
||||
void* b;
|
||||
unsigned char c;
|
||||
};
|
||||
|
||||
struct S1_wrapper {
|
||||
S1 s1;
|
||||
};
|
||||
|
||||
struct Not_S1_wrapper {
|
||||
unsigned char x;
|
||||
S1 s1;
|
||||
};
|
||||
|
||||
void test1() {
|
||||
void* p = new S1;
|
||||
S1_wrapper* s1w = static_cast<S1_wrapper*>(p); // GOOD
|
||||
}
|
||||
|
||||
void test2() {
|
||||
void* p = new S1_wrapper;
|
||||
S1* s1 = static_cast<S1*>(p); // GOOD
|
||||
}
|
||||
|
||||
void test3() {
|
||||
void* p = new S1;
|
||||
Not_S1_wrapper* s1w = static_cast<Not_S1_wrapper*>(p); // BAD
|
||||
}
|
||||
|
||||
void test4() {
|
||||
void* p = new Not_S1_wrapper;
|
||||
S1* s1 = static_cast<S1*>(p); // BAD
|
||||
}
|
||||
|
||||
struct HasBitFields {
|
||||
int x : 16;
|
||||
int y : 16;
|
||||
int z : 32;
|
||||
};
|
||||
|
||||
struct BufferStruct {
|
||||
unsigned char buffer[sizeof(HasBitFields)];
|
||||
};
|
||||
|
||||
void test5() {
|
||||
HasBitFields* p = new HasBitFields;
|
||||
BufferStruct* bs = reinterpret_cast<BufferStruct*>(p); // GOOD
|
||||
}
|
||||
|
||||
struct Animal {
|
||||
virtual ~Animal();
|
||||
};
|
||||
|
||||
struct Cat : public Animal {
|
||||
Cat();
|
||||
~Cat();
|
||||
};
|
||||
|
||||
struct Dog : public Animal {
|
||||
Dog();
|
||||
~Dog();
|
||||
};
|
||||
|
||||
void test6() {
|
||||
Animal* a = new Cat;
|
||||
Dog* d = static_cast<Dog*>(a); // BAD
|
||||
}
|
||||
|
||||
void test7() {
|
||||
Animal* a = new Cat;
|
||||
Dog* d = dynamic_cast<Dog*>(a); // GOOD
|
||||
}
|
||||
|
||||
void test8() {
|
||||
Animal* a = new Cat;
|
||||
Cat* d = static_cast<Cat*>(a); // GOOD
|
||||
}
|
||||
|
||||
void test9(bool b) {
|
||||
Animal* a;
|
||||
if(b) {
|
||||
a = new Cat;
|
||||
} else {
|
||||
a = new Dog;
|
||||
}
|
||||
if(b) {
|
||||
Cat* d = static_cast<Cat*>(a); // GOOD
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* The layout of S2 is:
|
||||
* 0: int
|
||||
* 8: void*
|
||||
* 16: unsigned char
|
||||
* 16 + pad: unsigned char
|
||||
* 32 + pad: int
|
||||
* 40 + pad: void*
|
||||
* 48 + pad: unsigned char
|
||||
*/
|
||||
struct S2 {
|
||||
S1 s1;
|
||||
unsigned char buffer[16];
|
||||
S1 s1_2;
|
||||
};
|
||||
|
||||
struct S2_prefix {
|
||||
int a;
|
||||
void* p;
|
||||
unsigned char c;
|
||||
};
|
||||
|
||||
void test10() {
|
||||
S2* s2 = new S2;
|
||||
S2_prefix* s2p = reinterpret_cast<S2_prefix*>(s2); // GOOD
|
||||
}
|
||||
|
||||
struct Not_S2_prefix {
|
||||
int a;
|
||||
void* p;
|
||||
void* p2;
|
||||
unsigned char c;
|
||||
};
|
||||
|
||||
void test11() {
|
||||
S2* s2 = new S2;
|
||||
Not_S2_prefix* s2p = reinterpret_cast<Not_S2_prefix*>(s2); // BAD
|
||||
}
|
||||
|
||||
struct HasSomeBitFields {
|
||||
int x : 16;
|
||||
int y;
|
||||
int z : 32;
|
||||
};
|
||||
|
||||
void test12() {
|
||||
// This has doesn't have any non-bitfield member, so we don't detect
|
||||
// the problem here since the query currently ignores bitfields.
|
||||
S1* s1 = new S1;
|
||||
HasBitFields* hbf = reinterpret_cast<HasBitFields*>(s1); // BAD [NOT DETECTED]
|
||||
|
||||
S1* s1_2 = new S1;
|
||||
// This one has a non-bitfield members. So we detect the problem
|
||||
HasSomeBitFields* hbf2 = reinterpret_cast<HasSomeBitFields*>(s1_2); // BAD
|
||||
}
|
||||
|
||||
void test13(bool b, Cat* c) {
|
||||
Animal* a;
|
||||
if(b) {
|
||||
a = c;
|
||||
} else {
|
||||
a = new Dog;
|
||||
}
|
||||
// This FP happens despite the `not GoodFlow::flowTo(sinkNode)` condition in the query
|
||||
// because we don't find a flow path from `a = c` to `static_cast<Cat*>(a)` because
|
||||
// the "source" (i.e., `a = c`) doesn't have an allocation.
|
||||
if(b) {
|
||||
Cat* d = static_cast<Cat*>(a); // GOOD [FALSE POSITIVE]
|
||||
}
|
||||
}
|
||||
|
||||
void test14(bool b) {
|
||||
Animal* a;
|
||||
if(b) {
|
||||
a = new Cat;
|
||||
} else {
|
||||
a = new Dog;
|
||||
}
|
||||
if(!b) {
|
||||
Cat* d = static_cast<Cat*>(a); // BAD [NOT DETECTED]
|
||||
}
|
||||
}
|
||||
|
||||
struct UInt64 { unsigned long u64; };
|
||||
struct UInt8 { unsigned char u8; };
|
||||
|
||||
void test14() {
|
||||
void* u64 = new UInt64;
|
||||
// ...
|
||||
UInt8* u8 = (UInt8*)u64; // GOOD
|
||||
}
|
||||
|
||||
struct UInt8_with_more { UInt8 u8; void* p; };
|
||||
|
||||
void test15() {
|
||||
void* u64 = new UInt64;
|
||||
// ...
|
||||
UInt8_with_more* u8 = (UInt8_with_more*)u64; // BAD
|
||||
}
|
||||
|
||||
struct SingleInt {
|
||||
int i;
|
||||
} __attribute__((packed));;
|
||||
|
||||
struct PairInts {
|
||||
int x, y;
|
||||
} __attribute__((packed));;
|
||||
|
||||
union MyUnion
|
||||
{
|
||||
PairInts p;
|
||||
unsigned long long foo;
|
||||
} __attribute__((packed));
|
||||
|
||||
void test16() {
|
||||
void* si = new SingleInt;
|
||||
// ...
|
||||
MyUnion* mu = (MyUnion*)si; // BAD [NOT DETECTED]
|
||||
}
|
||||
|
||||
struct UnrelatedStructSize {
|
||||
unsigned char buffer[1024];
|
||||
};
|
||||
|
||||
void test17() {
|
||||
void* p = new S1;
|
||||
UnrelatedStructSize* uss = static_cast<UnrelatedStructSize*>(p); // BAD
|
||||
}
|
||||
|
||||
struct TooLargeBufferSize {
|
||||
unsigned char buffer[sizeof(S1) + 1];
|
||||
};
|
||||
|
||||
void test18() {
|
||||
void* p = new S1;
|
||||
TooLargeBufferSize* uss = static_cast<TooLargeBufferSize*>(p); // BAD
|
||||
}
|
||||
|
||||
// semmle-extractor-options: --gcc -std=c++11
|
||||
Загрузка…
Ссылка в новой задаче