Skip to content

Commit 0f98e29

Browse files
jketemajketema
committed
C++: Cleanup minizip test
1 parent 09f6576 commit 0f98e29

File tree

2 files changed

+31
-70
lines changed

2 files changed

+31
-70
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.expected‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -25,17 +25,17 @@ edges
2525
| main.cpp:9:27:9:30 | libarchive_test output argument | main.cpp:10:24:10:27 | **argv | provenance | |
2626
| main.cpp:9:27:9:30 | libarchive_test output argument | main.cpp:11:21:11:24 | **argv | provenance | |
2727
| main.cpp:10:24:10:27 | **argv | main.cpp:10:24:10:27 | minizip_test output argument | provenance | |
28-
| main.cpp:10:24:10:27 | **argv | minizipTest.cpp:34:42:34:45 | **argv | provenance | |
28+
| main.cpp:10:24:10:27 | **argv | minizipTest.cpp:12:42:12:45 | **argv | provenance | |
2929
| main.cpp:10:24:10:27 | minizip_test output argument | main.cpp:11:21:11:24 | **argv | provenance | |
3030
| main.cpp:11:21:11:24 | **argv | zlibTest.cpp:80:33:80:36 | **argv | provenance | |
31-
| minizipTest.cpp:34:42:34:45 | **argv | minizipTest.cpp:34:42:34:45 | **argv | provenance | |
32-
| minizipTest.cpp:34:42:34:45 | **argv | minizipTest.cpp:40:52:40:67 | *access to array | provenance | |
33-
| minizipTest.cpp:34:42:34:45 | **argv | minizipTest.cpp:52:41:52:47 | *access to array | provenance | |
34-
| minizipTest.cpp:34:42:34:45 | **argv | minizipTest.cpp:67:13:67:19 | *access to array | provenance | |
35-
| minizipTest.cpp:52:29:52:38 | **zip_reader | minizipTest.cpp:58:30:58:39 | **zip_reader | provenance | |
36-
| minizipTest.cpp:52:29:52:38 | *zip_reader | minizipTest.cpp:58:30:58:39 | *zip_reader | provenance | |
37-
| minizipTest.cpp:52:41:52:47 | *access to array | minizipTest.cpp:52:29:52:38 | **zip_reader | provenance | Config |
38-
| minizipTest.cpp:52:41:52:47 | *access to array | minizipTest.cpp:52:29:52:38 | *zip_reader | provenance | Config |
31+
| minizipTest.cpp:12:42:12:45 | **argv | minizipTest.cpp:12:42:12:45 | **argv | provenance | |
32+
| minizipTest.cpp:12:42:12:45 | **argv | minizipTest.cpp:17:52:17:67 | *access to array | provenance | |
33+
| minizipTest.cpp:12:42:12:45 | **argv | minizipTest.cpp:24:41:24:47 | *access to array | provenance | |
34+
| minizipTest.cpp:12:42:12:45 | **argv | minizipTest.cpp:28:13:28:19 | *access to array | provenance | |
35+
| minizipTest.cpp:24:29:24:38 | **zip_reader | minizipTest.cpp:26:30:26:39 | **zip_reader | provenance | |
36+
| minizipTest.cpp:24:29:24:38 | *zip_reader | minizipTest.cpp:26:30:26:39 | *zip_reader | provenance | |
37+
| minizipTest.cpp:24:41:24:47 | *access to array | minizipTest.cpp:24:29:24:38 | **zip_reader | provenance | Config |
38+
| minizipTest.cpp:24:41:24:47 | *access to array | minizipTest.cpp:24:29:24:38 | *zip_reader | provenance | Config |
3939
| zlibTest.cpp:16:26:16:30 | *input | zlibTest.cpp:20:25:20:39 | *input | provenance | |
4040
| zlibTest.cpp:20:25:20:39 | *input | zlibTest.cpp:16:26:16:30 | *input | provenance | |
4141
| zlibTest.cpp:20:25:20:39 | *input | zlibTest.cpp:24:17:24:26 | & ... | provenance | Config |
@@ -103,15 +103,15 @@ nodes
103103
| main.cpp:10:24:10:27 | **argv | semmle.label | **argv |
104104
| main.cpp:10:24:10:27 | minizip_test output argument | semmle.label | minizip_test output argument |
105105
| main.cpp:11:21:11:24 | **argv | semmle.label | **argv |
106-
| minizipTest.cpp:34:42:34:45 | **argv | semmle.label | **argv |
107-
| minizipTest.cpp:34:42:34:45 | **argv | semmle.label | **argv |
108-
| minizipTest.cpp:40:52:40:67 | *access to array | semmle.label | *access to array |
109-
| minizipTest.cpp:52:29:52:38 | **zip_reader | semmle.label | **zip_reader |
110-
| minizipTest.cpp:52:29:52:38 | *zip_reader | semmle.label | *zip_reader |
111-
| minizipTest.cpp:52:41:52:47 | *access to array | semmle.label | *access to array |
112-
| minizipTest.cpp:58:30:58:39 | **zip_reader | semmle.label | **zip_reader |
113-
| minizipTest.cpp:58:30:58:39 | *zip_reader | semmle.label | *zip_reader |
114-
| minizipTest.cpp:67:13:67:19 | *access to array | semmle.label | *access to array |
106+
| minizipTest.cpp:12:42:12:45 | **argv | semmle.label | **argv |
107+
| minizipTest.cpp:12:42:12:45 | **argv | semmle.label | **argv |
108+
| minizipTest.cpp:17:52:17:67 | *access to array | semmle.label | *access to array |
109+
| minizipTest.cpp:24:29:24:38 | **zip_reader | semmle.label | **zip_reader |
110+
| minizipTest.cpp:24:29:24:38 | *zip_reader | semmle.label | *zip_reader |
111+
| minizipTest.cpp:24:41:24:47 | *access to array | semmle.label | *access to array |
112+
| minizipTest.cpp:26:30:26:39 | **zip_reader | semmle.label | **zip_reader |
113+
| minizipTest.cpp:26:30:26:39 | *zip_reader | semmle.label | *zip_reader |
114+
| minizipTest.cpp:28:13:28:19 | *access to array | semmle.label | *access to array |
115115
| zlibTest.cpp:16:26:16:30 | *input | semmle.label | *input |
116116
| zlibTest.cpp:16:26:16:30 | *input | semmle.label | *input |
117117
| zlibTest.cpp:20:25:20:39 | *input | semmle.label | *input |
@@ -151,7 +151,7 @@ subpaths
151151
| libarchiveTests.cpp:38:27:38:27 | *a | libarchiveTests.cpp:16:31:16:32 | *ar | libarchiveTests.cpp:16:31:16:32 | *ar | libarchiveTests.cpp:38:27:38:27 | read_data output argument |
152152
| main.cpp:8:23:8:26 | **argv | brotliTest.cpp:26:41:26:44 | **argv | brotliTest.cpp:26:41:26:44 | **argv | main.cpp:8:23:8:26 | brotli_test output argument |
153153
| main.cpp:9:27:9:30 | **argv | libarchiveTests.cpp:30:45:30:48 | **argv | libarchiveTests.cpp:30:45:30:48 | **argv | main.cpp:9:27:9:30 | libarchive_test output argument |
154-
| main.cpp:10:24:10:27 | **argv | minizipTest.cpp:34:42:34:45 | **argv | minizipTest.cpp:34:42:34:45 | **argv | main.cpp:10:24:10:27 | minizip_test output argument |
154+
| main.cpp:10:24:10:27 | **argv | minizipTest.cpp:12:42:12:45 | **argv | minizipTest.cpp:12:42:12:45 | **argv | main.cpp:10:24:10:27 | minizip_test output argument |
155155
| zlibTest.cpp:81:19:81:25 | *access to array | zlibTest.cpp:47:26:47:33 | *fileName | zlibTest.cpp:47:26:47:33 | *fileName | zlibTest.cpp:81:19:81:25 | UnsafeGzfread output argument |
156156
| zlibTest.cpp:82:18:82:24 | *access to array | zlibTest.cpp:57:25:57:32 | *fileName | zlibTest.cpp:57:25:57:32 | *fileName | zlibTest.cpp:82:18:82:24 | UnsafeGzgets output argument |
157157
| zlibTest.cpp:83:19:83:25 | *access to array | zlibTest.cpp:16:26:16:30 | *input | zlibTest.cpp:16:26:16:30 | *input | zlibTest.cpp:83:19:83:25 | UnsafeInflate output argument |
@@ -160,10 +160,10 @@ subpaths
160160
| brotliTest.cpp:28:42:28:60 | *access to array | main.cpp:7:33:7:36 | **argv | brotliTest.cpp:28:42:28:60 | *access to array | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
161161
| brotliTest.cpp:34:35:34:40 | *input2 | main.cpp:7:33:7:36 | **argv | brotliTest.cpp:34:35:34:40 | *input2 | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
162162
| libarchiveTests.cpp:22:41:22:42 | *ar | main.cpp:7:33:7:36 | **argv | libarchiveTests.cpp:22:41:22:42 | *ar | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
163-
| minizipTest.cpp:40:52:40:67 | *access to array | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:40:52:40:67 | *access to array | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
164-
| minizipTest.cpp:58:30:58:39 | **zip_reader | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:58:30:58:39 | **zip_reader | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
165-
| minizipTest.cpp:58:30:58:39 | *zip_reader | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:58:30:58:39 | *zip_reader | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
166-
| minizipTest.cpp:67:13:67:19 | *access to array | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:67:13:67:19 | *access to array | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
163+
| minizipTest.cpp:17:52:17:67 | *access to array | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:17:52:17:67 | *access to array | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
164+
| minizipTest.cpp:26:30:26:39 | **zip_reader | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:26:30:26:39 | **zip_reader | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
165+
| minizipTest.cpp:26:30:26:39 | *zip_reader | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:26:30:26:39 | *zip_reader | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
166+
| minizipTest.cpp:28:13:28:19 | *access to array | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:28:13:28:19 | *access to array | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
167167
| zlibTest.cpp:25:13:25:22 | & ... | main.cpp:7:33:7:36 | **argv | zlibTest.cpp:25:13:25:22 | & ... | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
168168
| zlibTest.cpp:41:20:41:26 | inFileZ | main.cpp:7:33:7:36 | **argv | zlibTest.cpp:41:20:41:26 | inFileZ | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
169169
| zlibTest.cpp:51:38:51:44 | inFileZ | main.cpp:7:33:7:36 | **argv | zlibTest.cpp:51:38:51:44 | inFileZ | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/minizipTest.cpp‎

Lines changed: 8 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,68 +1,29 @@
11
typedef signed int int32_t;
22

3-
void *mz_stream_os_create();
4-
5-
int32_t mz_zip_reader_open_file(void *handle, const char *path);
6-
7-
int32_t mz_zip_reader_open_file_in_memory(void *handle, const char *path);
8-
93
void *mz_zip_reader_create();
10-
4+
int32_t mz_zip_reader_open_file(void *handle, const char *path);
115
int32_t mz_zip_reader_goto_first_entry(void *pVoid);
12-
13-
int32_t mz_stream_os_open(void *pVoid, const char *path, int write);
14-
15-
void mz_stream_os_close(void *pVoid);
16-
17-
void mz_stream_os_delete(void **pVoid);
18-
19-
void mz_zip_reader_close(void *pVoid);
20-
21-
void mz_zip_reader_delete(void **pVoid);
22-
236
int32_t mz_zip_reader_entry_save(void *pVoid, int stream, int write);
24-
25-
7+
int32_t mz_zip_entry_read(void *pVoid, void *buf, int32_t i);
268
void UnzOpen(const char *string);
279

28-
int32_t mz_zip_entry_read(void *pVoid, void *buf, int32_t i);
29-
30-
void *mz_zip_create() {
31-
return nullptr;
32-
}
10+
void *mz_zip_create();
3311

3412
void minizip_test(int argc, const char **argv) {
3513
void *zip_handle = mz_zip_create();
3614
int32_t bytes_read;
37-
int32_t err;
3815
char buf[4096];
39-
do {
16+
while(true) {
4017
bytes_read = mz_zip_entry_read(zip_handle, (char *) argv[1], sizeof(buf)); // BAD
41-
if (bytes_read < 0) {
42-
err = bytes_read;
18+
if (bytes_read <= 0) {
19+
break;
4320
}
44-
// Do something with buf bytes
45-
} while (err == 1 && bytes_read > 0);
46-
47-
48-
const char *entry_path = "c:\\entry.dat";
21+
}
4922

5023
void *zip_reader = mz_zip_reader_create();
51-
5224
mz_zip_reader_open_file(zip_reader, argv[1]);
5325
mz_zip_reader_goto_first_entry(zip_reader);
54-
void *entry_stream = mz_stream_os_create();
55-
mz_stream_os_open(entry_stream, entry_path, 1);
56-
int file_stream;
57-
int mz_stream_os_write;
58-
mz_zip_reader_entry_save(zip_reader, file_stream, mz_stream_os_write); // BAD
59-
// the above sink is same as "mz_zip_reader_entry_save", "mz_zip_reader_entry_read", "mz_zip_reader_entry_save_process",
60-
// "mz_zip_reader_entry_save_file", "mz_zip_reader_entry_save_buffer", "mz_zip_reader_save_all" and "mz_zip_entry_read" functions
61-
mz_stream_os_close(entry_stream);
62-
mz_stream_os_delete(&entry_stream);
63-
mz_zip_reader_close(zip_reader);
64-
mz_zip_reader_delete(&zip_reader);
65-
26+
mz_zip_reader_entry_save(zip_reader, 0, 0); // BAD
6627

6728
UnzOpen(argv[3]); // BAD
6829
}

0 commit comments

Comments
 (0)