|
8 | 8 | * security |
9 | 9 | * external/cwe/cwe-775 |
10 | 10 | */ |
| 11 | + |
11 | 12 | import semmle.code.cpp.pointsto.PointsTo |
12 | 13 | import Negativity |
13 | 14 |
|
14 | | -predicate closeCall(FunctionCall fc, Variable v) |
15 | | -{ |
16 | | - (fc.getTarget().hasQualifiedName("close") and v.getAnAccess() = fc.getArgument(0)) |
| 15 | +predicate closeCall(FunctionCall fc, Variable v) { |
| 16 | + fc.getTarget().hasQualifiedName("close") and v.getAnAccess() = fc.getArgument(0) |
17 | 17 | or |
18 | 18 | exists(FunctionCall midcall, Function mid, int arg | |
19 | 19 | fc.getArgument(arg) = v.getAnAccess() and |
20 | 20 | fc.getTarget() = mid and |
21 | 21 | midcall.getEnclosingFunction() = mid and |
22 | | - closeCall(midcall, mid.getParameter(arg))) |
| 22 | + closeCall(midcall, mid.getParameter(arg)) |
| 23 | + ) |
23 | 24 | } |
24 | 25 |
|
25 | | -predicate openDefinition(LocalScopeVariable v, ControlFlowNode def) |
26 | | -{ |
27 | | - exists(Expr expr | |
28 | | - exprDefinition(v, def, expr) and allocateDescriptorCall(expr)) |
| 26 | +predicate openDefinition(LocalScopeVariable v, ControlFlowNode def) { |
| 27 | + exists(Expr expr | exprDefinition(v, def, expr) and allocateDescriptorCall(expr)) |
29 | 28 | } |
30 | 29 |
|
31 | | -predicate openReaches(ControlFlowNode def, ControlFlowNode node) |
32 | | -{ |
33 | | - exists(LocalScopeVariable v | |
34 | | - openDefinition(v, def) and node = def.getASuccessor()) |
| 30 | +predicate openReaches(ControlFlowNode def, ControlFlowNode node) { |
| 31 | + exists(LocalScopeVariable v | openDefinition(v, def) and node = def.getASuccessor()) |
35 | 32 | or |
36 | 33 | exists(LocalScopeVariable v, ControlFlowNode mid | |
37 | 34 | openDefinition(v, def) and |
38 | 35 | openReaches(def, mid) and |
39 | | - not(errorSuccessor(v, mid)) and |
40 | | - not(closeCall(mid, v)) and |
41 | | - not(assignedToFieldOrGlobal(v, mid)) and |
42 | | - node = mid.getASuccessor()) |
| 36 | + not errorSuccessor(v, mid) and |
| 37 | + not closeCall(mid, v) and |
| 38 | + not assignedToFieldOrGlobal(v, mid) and |
| 39 | + node = mid.getASuccessor() |
| 40 | + ) |
43 | 41 | } |
44 | 42 |
|
45 | | -predicate assignedToFieldOrGlobal(LocalScopeVariable v, Assignment assign) |
46 | | -{ |
| 43 | +predicate assignedToFieldOrGlobal(LocalScopeVariable v, Assignment assign) { |
47 | 44 | exists(Variable external | |
48 | 45 | assign.getRValue() = v.getAnAccess() and |
49 | 46 | assign.getLValue().(VariableAccess).getTarget() = external and |
50 | | - (external instanceof Field or external instanceof GlobalVariable)) |
| 47 | + (external instanceof Field or external instanceof GlobalVariable) |
| 48 | + ) |
51 | 49 | } |
52 | 50 |
|
53 | 51 | from LocalScopeVariable v, ControlFlowNode def, ReturnStmt ret |
54 | | -where openDefinition(v, def) |
55 | | - and openReaches(def, ret) |
56 | | - and checkedSuccess(v, ret) |
57 | | - and not(ret.getExpr().getAChild*() = v.getAnAccess()) |
58 | | - and exists(ReturnStmt other | other.getExpr() = v.getAnAccess()) |
| 52 | +where |
| 53 | + openDefinition(v, def) and |
| 54 | + openReaches(def, ret) and |
| 55 | + checkedSuccess(v, ret) and |
| 56 | + not ret.getExpr().getAChild*() = v.getAnAccess() and |
| 57 | + exists(ReturnStmt other | other.getExpr() = v.getAnAccess()) |
59 | 58 | select ret, |
60 | 59 | "Descriptor assigned to '" + v.getName().toString() + "' (line " + |
61 | | - def.getLocation().getStartLine().toString() + ") may not be closed." |
| 60 | + def.getLocation().getStartLine().toString() + ") may not be closed." |
0 commit comments