Skip to content

Commit d804229

Browse files
geoffw0geoffw0
committed
Rust: Add missing model.
1 parent 6c3566a commit d804229

File tree

3 files changed

+95
-24
lines changed

3 files changed

+95
-24
lines changed

‎rust/ql/lib/codeql/rust/frameworks/stdlib/core.model.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ extensions:
6060
- ["core::ptr::dangling", "ReturnValue", "pointer-invalidate", "manual"]
6161
- ["core::ptr::dangling_mut", "ReturnValue", "pointer-invalidate", "manual"]
6262
- ["core::ptr::null", "ReturnValue", "pointer-invalidate", "manual"]
63+
- ["core::ptr::null_mut", "ReturnValue", "pointer-invalidate", "manual"]
6364
- ["v8::primitives::null", "ReturnValue", "pointer-invalidate", "manual"]
6465
- addsTo:
6566
pack: codeql/rust-all

‎rust/ql/test/query-tests/security/CWE-825/AccessInvalidPointer.expected‎

Lines changed: 72 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,20 @@
1313
| deallocation.rs:130:14:130:15 | p1 | deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:130:14:130:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:123:23:123:40 | ...::dangling | invalid |
1414
| deallocation.rs:131:14:131:15 | p2 | deallocation.rs:124:21:124:42 | ...::dangling_mut | deallocation.rs:131:14:131:15 | p2 | This operation dereferences a pointer that may be $@. | deallocation.rs:124:21:124:42 | ...::dangling_mut | invalid |
1515
| deallocation.rs:132:14:132:15 | p3 | deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:132:14:132:15 | p3 | This operation dereferences a pointer that may be $@. | deallocation.rs:125:23:125:36 | ...::null | invalid |
16+
| deallocation.rs:163:13:163:15 | ptr | deallocation.rs:159:9:159:26 | ...::null_mut | deallocation.rs:163:13:163:15 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:159:9:159:26 | ...::null_mut | invalid |
17+
| deallocation.rs:166:13:166:15 | ptr | deallocation.rs:159:9:159:26 | ...::null_mut | deallocation.rs:166:13:166:15 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:159:9:159:26 | ...::null_mut | invalid |
18+
| deallocation.rs:175:13:175:15 | ptr | deallocation.rs:171:9:171:26 | ...::null_mut | deallocation.rs:175:13:175:15 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:171:9:171:26 | ...::null_mut | invalid |
19+
| deallocation.rs:178:13:178:15 | ptr | deallocation.rs:171:9:171:26 | ...::null_mut | deallocation.rs:178:13:178:15 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:171:9:171:26 | ...::null_mut | invalid |
20+
| deallocation.rs:186:24:186:26 | ptr | deallocation.rs:183:9:183:26 | ...::null_mut | deallocation.rs:186:24:186:26 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:183:9:183:26 | ...::null_mut | invalid |
21+
| deallocation.rs:190:24:190:26 | ptr | deallocation.rs:183:9:183:26 | ...::null_mut | deallocation.rs:190:24:190:26 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:183:9:183:26 | ...::null_mut | invalid |
22+
| deallocation.rs:194:25:194:27 | ptr | deallocation.rs:183:9:183:26 | ...::null_mut | deallocation.rs:194:25:194:27 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:183:9:183:26 | ...::null_mut | invalid |
23+
| deallocation.rs:202:24:202:26 | ptr | deallocation.rs:183:9:183:26 | ...::null_mut | deallocation.rs:202:24:202:26 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:183:9:183:26 | ...::null_mut | invalid |
24+
| deallocation.rs:202:24:202:26 | ptr | deallocation.rs:199:9:199:26 | ...::null_mut | deallocation.rs:202:24:202:26 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:199:9:199:26 | ...::null_mut | invalid |
25+
| deallocation.rs:210:7:210:9 | ptr | deallocation.rs:183:9:183:26 | ...::null_mut | deallocation.rs:210:7:210:9 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:183:9:183:26 | ...::null_mut | invalid |
26+
| deallocation.rs:210:7:210:9 | ptr | deallocation.rs:199:9:199:26 | ...::null_mut | deallocation.rs:210:7:210:9 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:199:9:199:26 | ...::null_mut | invalid |
27+
| deallocation.rs:210:7:210:9 | ptr | deallocation.rs:207:9:207:26 | ...::null_mut | deallocation.rs:210:7:210:9 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:207:9:207:26 | ...::null_mut | invalid |
28+
| deallocation.rs:226:13:226:21 | const_ptr | deallocation.rs:219:15:219:32 | ...::null_mut | deallocation.rs:226:13:226:21 | const_ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:219:15:219:32 | ...::null_mut | invalid |
29+
| deallocation.rs:229:13:229:21 | const_ptr | deallocation.rs:219:15:219:32 | ...::null_mut | deallocation.rs:229:13:229:21 | const_ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:219:15:219:32 | ...::null_mut | invalid |
1630
| deallocation.rs:274:15:274:16 | p1 | deallocation.rs:270:3:270:25 | ...::drop_in_place | deallocation.rs:274:15:274:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:270:3:270:25 | ...::drop_in_place | invalid |
1731
| deallocation.rs:274:15:274:16 | p1 | deallocation.rs:270:3:270:25 | ...::drop_in_place | deallocation.rs:274:15:274:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:270:3:270:25 | ...::drop_in_place | invalid |
1832
| deallocation.rs:342:18:342:20 | ptr | deallocation.rs:336:3:336:25 | ...::drop_in_place | deallocation.rs:342:18:342:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:336:3:336:25 | ...::drop_in_place | invalid |
@@ -32,7 +46,7 @@ edges
3246
| deallocation.rs:70:23:70:35 | [post] m2 as ... | deallocation.rs:90:7:90:8 | m2 | provenance | |
3347
| deallocation.rs:70:23:70:35 | [post] m2 as ... | deallocation.rs:95:33:95:34 | m2 | provenance | |
3448
| deallocation.rs:95:33:95:34 | m2 | deallocation.rs:95:5:95:31 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
35-
| deallocation.rs:112:3:112:12 | ...::free | deallocation.rs:112:14:112:40 | [post] my_ptr as ... | provenance | Src:MaD:8 MaD:8 |
49+
| deallocation.rs:112:3:112:12 | ...::free | deallocation.rs:112:14:112:40 | [post] my_ptr as ... | provenance | Src:MaD:9 MaD:9 |
3650
| deallocation.rs:112:14:112:40 | [post] my_ptr as ... | deallocation.rs:115:13:115:18 | my_ptr | provenance | |
3751
| deallocation.rs:123:6:123:7 | p1 | deallocation.rs:130:14:130:15 | p1 | provenance | |
3852
| deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:123:23:123:42 | ...::dangling(...) | provenance | Src:MaD:4 MaD:4 |
@@ -44,6 +58,32 @@ edges
4458
| deallocation.rs:125:6:125:7 | p3 | deallocation.rs:132:14:132:15 | p3 | provenance | |
4559
| deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:125:23:125:38 | ...::null(...) | provenance | Src:MaD:7 MaD:7 |
4660
| deallocation.rs:125:23:125:38 | ...::null(...) | deallocation.rs:125:6:125:7 | p3 | provenance | |
61+
| deallocation.rs:159:3:159:5 | ptr | deallocation.rs:163:13:163:15 | ptr | provenance | |
62+
| deallocation.rs:159:3:159:5 | ptr | deallocation.rs:166:13:166:15 | ptr | provenance | |
63+
| deallocation.rs:159:9:159:26 | ...::null_mut | deallocation.rs:159:9:159:28 | ...::null_mut(...) | provenance | Src:MaD:8 MaD:8 |
64+
| deallocation.rs:159:9:159:28 | ...::null_mut(...) | deallocation.rs:159:3:159:5 | ptr | provenance | |
65+
| deallocation.rs:171:3:171:5 | ptr | deallocation.rs:175:13:175:15 | ptr | provenance | |
66+
| deallocation.rs:171:3:171:5 | ptr | deallocation.rs:178:13:178:15 | ptr | provenance | |
67+
| deallocation.rs:171:9:171:26 | ...::null_mut | deallocation.rs:171:9:171:28 | ...::null_mut(...) | provenance | Src:MaD:8 MaD:8 |
68+
| deallocation.rs:171:9:171:28 | ...::null_mut(...) | deallocation.rs:171:3:171:5 | ptr | provenance | |
69+
| deallocation.rs:183:3:183:5 | ptr | deallocation.rs:186:24:186:26 | ptr | provenance | |
70+
| deallocation.rs:183:3:183:5 | ptr | deallocation.rs:190:24:190:26 | ptr | provenance | |
71+
| deallocation.rs:183:3:183:5 | ptr | deallocation.rs:194:25:194:27 | ptr | provenance | |
72+
| deallocation.rs:183:3:183:5 | ptr | deallocation.rs:202:24:202:26 | ptr | provenance | |
73+
| deallocation.rs:183:3:183:5 | ptr | deallocation.rs:210:7:210:9 | ptr | provenance | |
74+
| deallocation.rs:183:9:183:26 | ...::null_mut | deallocation.rs:183:9:183:28 | ...::null_mut(...) | provenance | Src:MaD:8 MaD:8 |
75+
| deallocation.rs:183:9:183:28 | ...::null_mut(...) | deallocation.rs:183:3:183:5 | ptr | provenance | |
76+
| deallocation.rs:199:3:199:5 | ptr | deallocation.rs:202:24:202:26 | ptr | provenance | |
77+
| deallocation.rs:199:3:199:5 | ptr | deallocation.rs:210:7:210:9 | ptr | provenance | |
78+
| deallocation.rs:199:9:199:26 | ...::null_mut | deallocation.rs:199:9:199:28 | ...::null_mut(...) | provenance | Src:MaD:8 MaD:8 |
79+
| deallocation.rs:199:9:199:28 | ...::null_mut(...) | deallocation.rs:199:3:199:5 | ptr | provenance | |
80+
| deallocation.rs:207:3:207:5 | ptr | deallocation.rs:210:7:210:9 | ptr | provenance | |
81+
| deallocation.rs:207:9:207:26 | ...::null_mut | deallocation.rs:207:9:207:28 | ...::null_mut(...) | provenance | Src:MaD:8 MaD:8 |
82+
| deallocation.rs:207:9:207:28 | ...::null_mut(...) | deallocation.rs:207:3:207:5 | ptr | provenance | |
83+
| deallocation.rs:219:3:219:11 | const_ptr | deallocation.rs:226:13:226:21 | const_ptr | provenance | |
84+
| deallocation.rs:219:3:219:11 | const_ptr | deallocation.rs:229:13:229:21 | const_ptr | provenance | |
85+
| deallocation.rs:219:15:219:32 | ...::null_mut | deallocation.rs:219:15:219:34 | ...::null_mut(...) | provenance | Src:MaD:8 MaD:8 |
86+
| deallocation.rs:219:15:219:34 | ...::null_mut(...) | deallocation.rs:219:3:219:11 | const_ptr | provenance | |
4787
| deallocation.rs:270:3:270:25 | ...::drop_in_place | deallocation.rs:270:27:270:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
4888
| deallocation.rs:270:3:270:25 | ...::drop_in_place | deallocation.rs:270:27:270:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
4989
| deallocation.rs:270:27:270:28 | [post] p1 | deallocation.rs:274:15:274:16 | p1 | provenance | |
@@ -58,7 +98,8 @@ models
5898
| 5 | Source: core::ptr::dangling_mut; ReturnValue; pointer-invalidate |
5999
| 6 | Source: core::ptr::drop_in_place; Argument[0]; pointer-invalidate |
60100
| 7 | Source: core::ptr::null; ReturnValue; pointer-invalidate |
61-
| 8 | Source: libc::unix::free; Argument[0]; pointer-invalidate |
101+
| 8 | Source: core::ptr::null_mut; ReturnValue; pointer-invalidate |
102+
| 9 | Source: libc::unix::free; Argument[0]; pointer-invalidate |
62103
nodes
63104
| deallocation.rs:20:3:20:21 | ...::dealloc | semmle.label | ...::dealloc |
64105
| deallocation.rs:20:23:20:24 | [post] m1 | semmle.label | [post] m1 |
@@ -92,6 +133,35 @@ nodes
92133
| deallocation.rs:130:14:130:15 | p1 | semmle.label | p1 |
93134
| deallocation.rs:131:14:131:15 | p2 | semmle.label | p2 |
94135
| deallocation.rs:132:14:132:15 | p3 | semmle.label | p3 |
136+
| deallocation.rs:159:3:159:5 | ptr | semmle.label | ptr |
137+
| deallocation.rs:159:9:159:26 | ...::null_mut | semmle.label | ...::null_mut |
138+
| deallocation.rs:159:9:159:28 | ...::null_mut(...) | semmle.label | ...::null_mut(...) |
139+
| deallocation.rs:163:13:163:15 | ptr | semmle.label | ptr |
140+
| deallocation.rs:166:13:166:15 | ptr | semmle.label | ptr |
141+
| deallocation.rs:171:3:171:5 | ptr | semmle.label | ptr |
142+
| deallocation.rs:171:9:171:26 | ...::null_mut | semmle.label | ...::null_mut |
143+
| deallocation.rs:171:9:171:28 | ...::null_mut(...) | semmle.label | ...::null_mut(...) |
144+
| deallocation.rs:175:13:175:15 | ptr | semmle.label | ptr |
145+
| deallocation.rs:178:13:178:15 | ptr | semmle.label | ptr |
146+
| deallocation.rs:183:3:183:5 | ptr | semmle.label | ptr |
147+
| deallocation.rs:183:9:183:26 | ...::null_mut | semmle.label | ...::null_mut |
148+
| deallocation.rs:183:9:183:28 | ...::null_mut(...) | semmle.label | ...::null_mut(...) |
149+
| deallocation.rs:186:24:186:26 | ptr | semmle.label | ptr |
150+
| deallocation.rs:190:24:190:26 | ptr | semmle.label | ptr |
151+
| deallocation.rs:194:25:194:27 | ptr | semmle.label | ptr |
152+
| deallocation.rs:199:3:199:5 | ptr | semmle.label | ptr |
153+
| deallocation.rs:199:9:199:26 | ...::null_mut | semmle.label | ...::null_mut |
154+
| deallocation.rs:199:9:199:28 | ...::null_mut(...) | semmle.label | ...::null_mut(...) |
155+
| deallocation.rs:202:24:202:26 | ptr | semmle.label | ptr |
156+
| deallocation.rs:207:3:207:5 | ptr | semmle.label | ptr |
157+
| deallocation.rs:207:9:207:26 | ...::null_mut | semmle.label | ...::null_mut |
158+
| deallocation.rs:207:9:207:28 | ...::null_mut(...) | semmle.label | ...::null_mut(...) |
159+
| deallocation.rs:210:7:210:9 | ptr | semmle.label | ptr |
160+
| deallocation.rs:219:3:219:11 | const_ptr | semmle.label | const_ptr |
161+
| deallocation.rs:219:15:219:32 | ...::null_mut | semmle.label | ...::null_mut |
162+
| deallocation.rs:219:15:219:34 | ...::null_mut(...) | semmle.label | ...::null_mut(...) |
163+
| deallocation.rs:226:13:226:21 | const_ptr | semmle.label | const_ptr |
164+
| deallocation.rs:229:13:229:21 | const_ptr | semmle.label | const_ptr |
95165
| deallocation.rs:270:3:270:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
96166
| deallocation.rs:270:3:270:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
97167
| deallocation.rs:270:27:270:28 | [post] p1 | semmle.label | [post] p1 |

‎rust/ql/test/query-tests/security/CWE-825/deallocation.rs‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -155,59 +155,59 @@ pub unsafe fn test_ptr_invalid_conditions(mode: i32) {
155155
let mut ptr = std::alloc::alloc(layout) as *mut MyObject;
156156
(*ptr).value = 0; // good
157157

158-
if mode == 121 {
159-
ptr = std::ptr::null_mut(); // (causes a panic below)
158+
if mode == 121 { // (causes a panic below)
159+
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
160160
}
161161

162162
if ptr.is_null() {
163-
let v = (*ptr).value; // $ MISSING: Alert[rust/access-invalid-pointer]
163+
let v = (*ptr).value; // $ Alert[rust/access-invalid-pointer]
164164
println!(" cond1 v = {v}");
165165
} else {
166-
let v = (*ptr).value; // good - unreachable with null pointer
166+
let v = (*ptr).value; // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - unreachable with null pointer
167167
println!(" cond2 v = {v}");
168168
}
169169

170-
if mode == 122 {
171-
ptr = std::ptr::null_mut(); // (causes a panic below)
170+
if mode == 122 { // (causes a panic below)
171+
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
172172
}
173173

174174
if !(ptr.is_null()) {
175-
let v = (*ptr).value; // good - unreachable with null pointer
175+
let v = (*ptr).value; // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - unreachable with null pointer
176176
println!(" cond3 v = {v}");
177177
} else {
178-
let v = (*ptr).value; // $ MISSING: Alert[rust/access-invalid-pointer]
178+
let v = (*ptr).value; // $ Alert[rust/access-invalid-pointer]
179179
println!(" cond4 v = {v}");
180180
}
181181

182-
if mode == 123 {
183-
ptr = std::ptr::null_mut(); // (causes a panic below)
182+
if mode == 123 { // (causes a panic below)
183+
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
184184
}
185185

186-
if ptr.is_null() || (*ptr).value == 0 { // good - deref is protected by short-circuiting
186+
if ptr.is_null() || (*ptr).value == 0 { // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - deref is protected by short-circuiting
187187
println!(" cond5");
188188
}
189189

190-
if ptr.is_null() || (*ptr).is_zero() { // good - deref is protected by short-circuiting
190+
if ptr.is_null() || (*ptr).is_zero() { // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - deref is protected by short-circuiting
191191
println!(" cond6");
192192
}
193193

194-
if !ptr.is_null() || (*ptr).value == 0 { // $ MISSING: Alert[rust/access-invalid-pointer]
194+
if !ptr.is_null() || (*ptr).value == 0 { // $ Alert[rust/access-invalid-pointer]
195195
println!(" cond7");
196196
}
197197

198-
if mode == 124 {
199-
ptr = std::ptr::null_mut(); // (causes a panic below)
198+
if mode == 124 { // (causes a panic below)
199+
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
200200
}
201201

202-
if ptr.is_null() && (*ptr).is_zero() { // $ MISSING: Alert[rust/access-invalid-pointer]
202+
if ptr.is_null() && (*ptr).is_zero() { // $ Alert[rust/access-invalid-pointer]
203203
println!(" cond8");
204204
}
205205

206-
if mode == 125 {
207-
ptr = std::ptr::null_mut(); // (causes a panic below)
206+
if mode == 125 { // (causes a panic below)
207+
ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
208208
}
209209

210-
if (*ptr).is_zero() || ptr.is_null() { // $ MISSING: Alert[rust/access-invalid-pointer]
210+
if (*ptr).is_zero() || ptr.is_null() { // $ Alert[rust/access-invalid-pointer]
211211
println!(" cond9");
212212
}
213213

@@ -216,17 +216,17 @@ pub unsafe fn test_ptr_invalid_conditions(mode: i32) {
216216
let const_ptr;
217217

218218
if mode == 126 { // (causes a panic below)
219-
const_ptr = std::ptr::null_mut();
219+
const_ptr = std::ptr::null_mut(); // $ Source[rust/access-invalid-pointer]
220220
} else {
221221
const_ptr = std::alloc::alloc(layout) as *mut MyObject;
222222
(*const_ptr).value = 0; // good
223223
}
224224

225225
if const_ptr.is_null() {
226-
let v = (*const_ptr).value; // $ MISSING: Alert[rust/access-invalid-pointer]
226+
let v = (*const_ptr).value; // $ Alert[rust/access-invalid-pointer]
227227
println!(" cond10 v = {v}");
228228
} else {
229-
let v = (*const_ptr).value; // good - unreachable with null pointer
229+
let v = (*const_ptr).value; // $ SPURIOUS: Alert[rust/access-invalid-pointer] good - unreachable with null pointer
230230
println!(" cond11 v = {v}");
231231
}
232232
}

0 commit comments

Comments
 (0)