Skip to content

Commit e0f0305

Browse files
geoffw0geoffw0
committed
Rust: Add test cases for rust/access-invalid-pointer based on real world FPs.
1 parent bfa3562 commit e0f0305

File tree

4 files changed

+142
-65
lines changed

4 files changed

+142
-65
lines changed

‎rust/ql/test/query-tests/security/CWE-825/AccessAfterLifetime.expected‎

Lines changed: 47 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -24,27 +24,27 @@
2424
| lifetime.rs:808:23:808:25 | ptr | lifetime.rs:798:9:798:12 | &val | lifetime.rs:808:23:808:25 | ptr | Access of a pointer to $@ after its lifetime has ended. | lifetime.rs:796:6:796:8 | val | val |
2525
| main.rs:64:23:64:24 | p2 | main.rs:44:26:44:28 | &b2 | main.rs:64:23:64:24 | p2 | Access of a pointer to $@ after its lifetime has ended. | main.rs:43:13:43:14 | b2 | b2 |
2626
edges
27-
| deallocation.rs:148:6:148:7 | p1 | deallocation.rs:151:14:151:15 | p1 | provenance | |
28-
| deallocation.rs:148:6:148:7 | p1 | deallocation.rs:158:14:158:15 | p1 | provenance | |
29-
| deallocation.rs:148:30:148:38 | &raw const my_buffer | deallocation.rs:148:6:148:7 | p1 | provenance | |
30-
| deallocation.rs:228:28:228:43 | ...: ... | deallocation.rs:230:18:230:20 | ptr | provenance | |
31-
| deallocation.rs:240:27:240:42 | ...: ... | deallocation.rs:248:18:248:20 | ptr | provenance | |
32-
| deallocation.rs:257:7:257:10 | ptr1 | deallocation.rs:260:4:260:7 | ptr1 | provenance | |
33-
| deallocation.rs:257:7:257:10 | ptr1 | deallocation.rs:260:4:260:7 | ptr1 | provenance | |
34-
| deallocation.rs:257:14:257:33 | &raw mut ... | deallocation.rs:257:7:257:10 | ptr1 | provenance | |
35-
| deallocation.rs:258:7:258:10 | ptr2 | deallocation.rs:261:4:261:7 | ptr2 | provenance | |
36-
| deallocation.rs:258:7:258:10 | ptr2 | deallocation.rs:261:4:261:7 | ptr2 | provenance | |
37-
| deallocation.rs:258:14:258:33 | &raw mut ... | deallocation.rs:258:7:258:10 | ptr2 | provenance | |
38-
| deallocation.rs:260:4:260:7 | ptr1 | deallocation.rs:263:27:263:30 | ptr1 | provenance | |
39-
| deallocation.rs:261:4:261:7 | ptr2 | deallocation.rs:265:26:265:29 | ptr2 | provenance | |
40-
| deallocation.rs:263:27:263:30 | ptr1 | deallocation.rs:228:28:228:43 | ...: ... | provenance | |
41-
| deallocation.rs:265:26:265:29 | ptr2 | deallocation.rs:240:27:240:42 | ...: ... | provenance | |
42-
| deallocation.rs:276:6:276:9 | ptr1 | deallocation.rs:279:13:279:16 | ptr1 | provenance | |
43-
| deallocation.rs:276:6:276:9 | ptr1 | deallocation.rs:287:13:287:16 | ptr1 | provenance | |
44-
| deallocation.rs:276:13:276:28 | &raw mut ... | deallocation.rs:276:6:276:9 | ptr1 | provenance | |
45-
| deallocation.rs:295:6:295:9 | ptr2 | deallocation.rs:298:13:298:16 | ptr2 | provenance | |
46-
| deallocation.rs:295:6:295:9 | ptr2 | deallocation.rs:308:13:308:16 | ptr2 | provenance | |
47-
| deallocation.rs:295:13:295:28 | &raw mut ... | deallocation.rs:295:6:295:9 | ptr2 | provenance | |
27+
| deallocation.rs:220:6:220:7 | p1 | deallocation.rs:223:14:223:15 | p1 | provenance | |
28+
| deallocation.rs:220:6:220:7 | p1 | deallocation.rs:230:14:230:15 | p1 | provenance | |
29+
| deallocation.rs:220:30:220:38 | &raw const my_buffer | deallocation.rs:220:6:220:7 | p1 | provenance | |
30+
| deallocation.rs:300:28:300:43 | ...: ... | deallocation.rs:302:18:302:20 | ptr | provenance | |
31+
| deallocation.rs:312:27:312:42 | ...: ... | deallocation.rs:320:18:320:20 | ptr | provenance | |
32+
| deallocation.rs:329:7:329:10 | ptr1 | deallocation.rs:332:4:332:7 | ptr1 | provenance | |
33+
| deallocation.rs:329:7:329:10 | ptr1 | deallocation.rs:332:4:332:7 | ptr1 | provenance | |
34+
| deallocation.rs:329:14:329:33 | &raw mut ... | deallocation.rs:329:7:329:10 | ptr1 | provenance | |
35+
| deallocation.rs:330:7:330:10 | ptr2 | deallocation.rs:333:4:333:7 | ptr2 | provenance | |
36+
| deallocation.rs:330:7:330:10 | ptr2 | deallocation.rs:333:4:333:7 | ptr2 | provenance | |
37+
| deallocation.rs:330:14:330:33 | &raw mut ... | deallocation.rs:330:7:330:10 | ptr2 | provenance | |
38+
| deallocation.rs:332:4:332:7 | ptr1 | deallocation.rs:335:27:335:30 | ptr1 | provenance | |
39+
| deallocation.rs:333:4:333:7 | ptr2 | deallocation.rs:337:26:337:29 | ptr2 | provenance | |
40+
| deallocation.rs:335:27:335:30 | ptr1 | deallocation.rs:300:28:300:43 | ...: ... | provenance | |
41+
| deallocation.rs:337:26:337:29 | ptr2 | deallocation.rs:312:27:312:42 | ...: ... | provenance | |
42+
| deallocation.rs:348:6:348:9 | ptr1 | deallocation.rs:351:13:351:16 | ptr1 | provenance | |
43+
| deallocation.rs:348:6:348:9 | ptr1 | deallocation.rs:359:13:359:16 | ptr1 | provenance | |
44+
| deallocation.rs:348:13:348:28 | &raw mut ... | deallocation.rs:348:6:348:9 | ptr1 | provenance | |
45+
| deallocation.rs:367:6:367:9 | ptr2 | deallocation.rs:370:13:370:16 | ptr2 | provenance | |
46+
| deallocation.rs:367:6:367:9 | ptr2 | deallocation.rs:380:13:380:16 | ptr2 | provenance | |
47+
| deallocation.rs:367:13:367:28 | &raw mut ... | deallocation.rs:367:6:367:9 | ptr2 | provenance | |
4848
| lifetime.rs:21:2:21:18 | return ... | lifetime.rs:54:11:54:30 | get_local_dangling(...) | provenance | |
4949
| lifetime.rs:21:9:21:18 | &my_local1 | lifetime.rs:21:2:21:18 | return ... | provenance | |
5050
| lifetime.rs:27:2:27:22 | return ... | lifetime.rs:55:11:55:34 | get_local_dangling_mut(...) | provenance | |
@@ -234,32 +234,32 @@ models
234234
| 4 | Summary: <alloc::boxed::Box>::as_ptr; Argument[0].Reference.Reference; ReturnValue.Reference; value |
235235
| 5 | Summary: core::ptr::from_ref; Argument[0]; ReturnValue; value |
236236
nodes
237-
| deallocation.rs:148:6:148:7 | p1 | semmle.label | p1 |
238-
| deallocation.rs:148:30:148:38 | &raw const my_buffer | semmle.label | &raw const my_buffer |
239-
| deallocation.rs:151:14:151:15 | p1 | semmle.label | p1 |
240-
| deallocation.rs:158:14:158:15 | p1 | semmle.label | p1 |
241-
| deallocation.rs:228:28:228:43 | ...: ... | semmle.label | ...: ... |
242-
| deallocation.rs:230:18:230:20 | ptr | semmle.label | ptr |
243-
| deallocation.rs:240:27:240:42 | ...: ... | semmle.label | ...: ... |
244-
| deallocation.rs:248:18:248:20 | ptr | semmle.label | ptr |
245-
| deallocation.rs:257:7:257:10 | ptr1 | semmle.label | ptr1 |
246-
| deallocation.rs:257:14:257:33 | &raw mut ... | semmle.label | &raw mut ... |
247-
| deallocation.rs:258:7:258:10 | ptr2 | semmle.label | ptr2 |
248-
| deallocation.rs:258:14:258:33 | &raw mut ... | semmle.label | &raw mut ... |
249-
| deallocation.rs:260:4:260:7 | ptr1 | semmle.label | ptr1 |
250-
| deallocation.rs:260:4:260:7 | ptr1 | semmle.label | ptr1 |
251-
| deallocation.rs:261:4:261:7 | ptr2 | semmle.label | ptr2 |
252-
| deallocation.rs:261:4:261:7 | ptr2 | semmle.label | ptr2 |
253-
| deallocation.rs:263:27:263:30 | ptr1 | semmle.label | ptr1 |
254-
| deallocation.rs:265:26:265:29 | ptr2 | semmle.label | ptr2 |
255-
| deallocation.rs:276:6:276:9 | ptr1 | semmle.label | ptr1 |
256-
| deallocation.rs:276:13:276:28 | &raw mut ... | semmle.label | &raw mut ... |
257-
| deallocation.rs:279:13:279:16 | ptr1 | semmle.label | ptr1 |
258-
| deallocation.rs:287:13:287:16 | ptr1 | semmle.label | ptr1 |
259-
| deallocation.rs:295:6:295:9 | ptr2 | semmle.label | ptr2 |
260-
| deallocation.rs:295:13:295:28 | &raw mut ... | semmle.label | &raw mut ... |
261-
| deallocation.rs:298:13:298:16 | ptr2 | semmle.label | ptr2 |
262-
| deallocation.rs:308:13:308:16 | ptr2 | semmle.label | ptr2 |
237+
| deallocation.rs:220:6:220:7 | p1 | semmle.label | p1 |
238+
| deallocation.rs:220:30:220:38 | &raw const my_buffer | semmle.label | &raw const my_buffer |
239+
| deallocation.rs:223:14:223:15 | p1 | semmle.label | p1 |
240+
| deallocation.rs:230:14:230:15 | p1 | semmle.label | p1 |
241+
| deallocation.rs:300:28:300:43 | ...: ... | semmle.label | ...: ... |
242+
| deallocation.rs:302:18:302:20 | ptr | semmle.label | ptr |
243+
| deallocation.rs:312:27:312:42 | ...: ... | semmle.label | ...: ... |
244+
| deallocation.rs:320:18:320:20 | ptr | semmle.label | ptr |
245+
| deallocation.rs:329:7:329:10 | ptr1 | semmle.label | ptr1 |
246+
| deallocation.rs:329:14:329:33 | &raw mut ... | semmle.label | &raw mut ... |
247+
| deallocation.rs:330:7:330:10 | ptr2 | semmle.label | ptr2 |
248+
| deallocation.rs:330:14:330:33 | &raw mut ... | semmle.label | &raw mut ... |
249+
| deallocation.rs:332:4:332:7 | ptr1 | semmle.label | ptr1 |
250+
| deallocation.rs:332:4:332:7 | ptr1 | semmle.label | ptr1 |
251+
| deallocation.rs:333:4:333:7 | ptr2 | semmle.label | ptr2 |
252+
| deallocation.rs:333:4:333:7 | ptr2 | semmle.label | ptr2 |
253+
| deallocation.rs:335:27:335:30 | ptr1 | semmle.label | ptr1 |
254+
| deallocation.rs:337:26:337:29 | ptr2 | semmle.label | ptr2 |
255+
| deallocation.rs:348:6:348:9 | ptr1 | semmle.label | ptr1 |
256+
| deallocation.rs:348:13:348:28 | &raw mut ... | semmle.label | &raw mut ... |
257+
| deallocation.rs:351:13:351:16 | ptr1 | semmle.label | ptr1 |
258+
| deallocation.rs:359:13:359:16 | ptr1 | semmle.label | ptr1 |
259+
| deallocation.rs:367:6:367:9 | ptr2 | semmle.label | ptr2 |
260+
| deallocation.rs:367:13:367:28 | &raw mut ... | semmle.label | &raw mut ... |
261+
| deallocation.rs:370:13:370:16 | ptr2 | semmle.label | ptr2 |
262+
| deallocation.rs:380:13:380:16 | ptr2 | semmle.label | ptr2 |
263263
| lifetime.rs:21:2:21:18 | return ... | semmle.label | return ... |
264264
| lifetime.rs:21:9:21:18 | &my_local1 | semmle.label | &my_local1 |
265265
| lifetime.rs:27:2:27:22 | return ... | semmle.label | return ... |

‎rust/ql/test/query-tests/security/CWE-825/AccessInvalidPointer.expected‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@
1313
| deallocation.rs:130:14:130:15 | p1 | deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:130:14:130:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:123:23:123:40 | ...::dangling | invalid |
1414
| deallocation.rs:131:14:131:15 | p2 | deallocation.rs:124:21:124:42 | ...::dangling_mut | deallocation.rs:131:14:131:15 | p2 | This operation dereferences a pointer that may be $@. | deallocation.rs:124:21:124:42 | ...::dangling_mut | invalid |
1515
| deallocation.rs:132:14:132:15 | p3 | deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:132:14:132:15 | p3 | This operation dereferences a pointer that may be $@. | deallocation.rs:125:23:125:36 | ...::null | invalid |
16-
| deallocation.rs:180:15:180:16 | p1 | deallocation.rs:176:3:176:25 | ...::drop_in_place | deallocation.rs:180:15:180:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:176:3:176:25 | ...::drop_in_place | invalid |
17-
| deallocation.rs:180:15:180:16 | p1 | deallocation.rs:176:3:176:25 | ...::drop_in_place | deallocation.rs:180:15:180:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:176:3:176:25 | ...::drop_in_place | invalid |
18-
| deallocation.rs:248:18:248:20 | ptr | deallocation.rs:242:3:242:25 | ...::drop_in_place | deallocation.rs:248:18:248:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:242:3:242:25 | ...::drop_in_place | invalid |
19-
| deallocation.rs:248:18:248:20 | ptr | deallocation.rs:242:3:242:25 | ...::drop_in_place | deallocation.rs:248:18:248:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:242:3:242:25 | ...::drop_in_place | invalid |
16+
| deallocation.rs:252:15:252:16 | p1 | deallocation.rs:248:3:248:25 | ...::drop_in_place | deallocation.rs:252:15:252:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:248:3:248:25 | ...::drop_in_place | invalid |
17+
| deallocation.rs:252:15:252:16 | p1 | deallocation.rs:248:3:248:25 | ...::drop_in_place | deallocation.rs:252:15:252:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:248:3:248:25 | ...::drop_in_place | invalid |
18+
| deallocation.rs:320:18:320:20 | ptr | deallocation.rs:314:3:314:25 | ...::drop_in_place | deallocation.rs:320:18:320:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:314:3:314:25 | ...::drop_in_place | invalid |
19+
| deallocation.rs:320:18:320:20 | ptr | deallocation.rs:314:3:314:25 | ...::drop_in_place | deallocation.rs:320:18:320:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:314:3:314:25 | ...::drop_in_place | invalid |
2020
edges
2121
| deallocation.rs:20:3:20:21 | ...::dealloc | deallocation.rs:20:23:20:24 | [post] m1 | provenance | Src:MaD:3 MaD:3 |
2222
| deallocation.rs:20:23:20:24 | [post] m1 | deallocation.rs:26:15:26:16 | m1 | provenance | |
@@ -44,12 +44,12 @@ edges
4444
| deallocation.rs:125:6:125:7 | p3 | deallocation.rs:132:14:132:15 | p3 | provenance | |
4545
| deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:125:23:125:38 | ...::null(...) | provenance | Src:MaD:7 MaD:7 |
4646
| deallocation.rs:125:23:125:38 | ...::null(...) | deallocation.rs:125:6:125:7 | p3 | provenance | |
47-
| deallocation.rs:176:3:176:25 | ...::drop_in_place | deallocation.rs:176:27:176:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
48-
| deallocation.rs:176:3:176:25 | ...::drop_in_place | deallocation.rs:176:27:176:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
49-
| deallocation.rs:176:27:176:28 | [post] p1 | deallocation.rs:180:15:180:16 | p1 | provenance | |
50-
| deallocation.rs:242:3:242:25 | ...::drop_in_place | deallocation.rs:242:27:242:29 | [post] ptr | provenance | Src:MaD:6 MaD:6 |
51-
| deallocation.rs:242:3:242:25 | ...::drop_in_place | deallocation.rs:242:27:242:29 | [post] ptr | provenance | Src:MaD:6 MaD:6 |
52-
| deallocation.rs:242:27:242:29 | [post] ptr | deallocation.rs:248:18:248:20 | ptr | provenance | |
47+
| deallocation.rs:248:3:248:25 | ...::drop_in_place | deallocation.rs:248:27:248:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
48+
| deallocation.rs:248:3:248:25 | ...::drop_in_place | deallocation.rs:248:27:248:28 | [post] p1 | provenance | Src:MaD:6 MaD:6 |
49+
| deallocation.rs:248:27:248:28 | [post] p1 | deallocation.rs:252:15:252:16 | p1 | provenance | |
50+
| deallocation.rs:314:3:314:25 | ...::drop_in_place | deallocation.rs:314:27:314:29 | [post] ptr | provenance | Src:MaD:6 MaD:6 |
51+
| deallocation.rs:314:3:314:25 | ...::drop_in_place | deallocation.rs:314:27:314:29 | [post] ptr | provenance | Src:MaD:6 MaD:6 |
52+
| deallocation.rs:314:27:314:29 | [post] ptr | deallocation.rs:320:18:320:20 | ptr | provenance | |
5353
models
5454
| 1 | Sink: core::ptr::read; Argument[0]; pointer-access |
5555
| 2 | Sink: core::ptr::write; Argument[0]; pointer-access |
@@ -92,12 +92,12 @@ nodes
9292
| deallocation.rs:130:14:130:15 | p1 | semmle.label | p1 |
9393
| deallocation.rs:131:14:131:15 | p2 | semmle.label | p2 |
9494
| deallocation.rs:132:14:132:15 | p3 | semmle.label | p3 |
95-
| deallocation.rs:176:3:176:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
96-
| deallocation.rs:176:3:176:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
97-
| deallocation.rs:176:27:176:28 | [post] p1 | semmle.label | [post] p1 |
98-
| deallocation.rs:180:15:180:16 | p1 | semmle.label | p1 |
99-
| deallocation.rs:242:3:242:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
100-
| deallocation.rs:242:3:242:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
101-
| deallocation.rs:242:27:242:29 | [post] ptr | semmle.label | [post] ptr |
102-
| deallocation.rs:248:18:248:20 | ptr | semmle.label | ptr |
95+
| deallocation.rs:248:3:248:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
96+
| deallocation.rs:248:3:248:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
97+
| deallocation.rs:248:27:248:28 | [post] p1 | semmle.label | [post] p1 |
98+
| deallocation.rs:252:15:252:16 | p1 | semmle.label | p1 |
99+
| deallocation.rs:314:3:314:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
100+
| deallocation.rs:314:3:314:25 | ...::drop_in_place | semmle.label | ...::drop_in_place |
101+
| deallocation.rs:314:27:314:29 | [post] ptr | semmle.label | [post] ptr |
102+
| deallocation.rs:320:18:320:20 | ptr | semmle.label | ptr |
103103
subpaths

‎rust/ql/test/query-tests/security/CWE-825/deallocation.rs‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,78 @@ pub fn test_ptr_invalid(mode: i32) {
137137
}
138138
}
139139

140+
struct MyObject {
141+
value: i64
142+
}
143+
144+
impl MyObject {
145+
fn is_zero(&self) -> bool {
146+
self.value == 0
147+
}
148+
}
149+
150+
pub unsafe fn test_ptr_invalid_conditions(mode: i32) {
151+
let layout = std::alloc::Layout::new::<MyObject>();
152+
let mut ptr = std::alloc::alloc(layout) as *mut MyObject;
153+
(*ptr).value = 0; // good
154+
155+
if mode == 121 {
156+
ptr = std::ptr::null_mut(); // (causes a panic below)
157+
}
158+
159+
if ptr.is_null() {
160+
let v = (*ptr).value; // $ MISSING: Alert[rust/access-invalid-pointer]
161+
println!(" cond1 v = {v}");
162+
} else {
163+
let v = (*ptr).value; // good - unreachable with null pointer
164+
println!(" cond2 v = {v}");
165+
}
166+
167+
if mode == 122 {
168+
ptr = std::ptr::null_mut(); // (causes a panic below)
169+
}
170+
171+
if !(ptr.is_null()) {
172+
let v = (*ptr).value; // good - unreachable with null pointer
173+
println!(" cond3 v = {v}");
174+
} else {
175+
let v = (*ptr).value; // $ MISSING: Alert[rust/access-invalid-pointer]
176+
println!(" cond4 v = {v}");
177+
}
178+
179+
if mode == 123 {
180+
ptr = std::ptr::null_mut(); // (causes a panic below)
181+
}
182+
183+
if ptr.is_null() || (*ptr).value == 0 { // good - deref is protected by short-circuiting
184+
println!(" cond5");
185+
}
186+
187+
if ptr.is_null() || (*ptr).is_zero() { // good - deref is protected by short-circuiting
188+
println!(" cond6");
189+
}
190+
191+
if !ptr.is_null() || (*ptr).value == 0 { // $ MISSING: Alert[rust/access-invalid-pointer]
192+
println!(" cond7");
193+
}
194+
195+
if mode == 124 {
196+
ptr = std::ptr::null_mut(); // (causes a panic below)
197+
}
198+
199+
if ptr.is_null() && (*ptr).is_zero() { // $ MISSING: Alert[rust/access-invalid-pointer]
200+
println!(" cond8");
201+
}
202+
203+
if mode == 125 {
204+
ptr = std::ptr::null_mut(); // (causes a panic below)
205+
}
206+
207+
if (*ptr).is_zero() || ptr.is_null() { // $ MISSING: Alert[rust/access-invalid-pointer]
208+
println!(" cond9");
209+
}
210+
}
211+
140212
// --- drop ---
141213

142214
struct MyBuffer {

‎rust/ql/test/query-tests/security/CWE-825/main.rs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,11 @@ fn main() {
126126
println!("test_ptr_invalid:");
127127
test_ptr_invalid(mode);
128128

129+
println!("test_ptr_invalid_conditions:");
130+
unsafe {
131+
test_ptr_invalid_conditions(mode);
132+
}
133+
129134
println!("test_drop:");
130135
test_drop();
131136

0 commit comments

Comments
 (0)