Skip to content

Commit f7dda1b

Browse files
jbjjbj
authored
Merge pull request #1213 from geoffw0/pointerscaling2
CPP: De-duplicate the PointerScaling queries.
2 parents 19b05c5 + f040755 commit f7dda1b

File tree

6 files changed

+114
-293
lines changed

6 files changed

+114
-293
lines changed

‎cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScaling.ql‎

Lines changed: 0 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -9,111 +9,8 @@
99
* @tags security
1010
* external/cwe/cwe-468
1111
*/
12-
import cpp
13-
import semmle.code.cpp.controlflow.SSA
1412
import IncorrectPointerScalingCommon
1513

16-
private predicate isPointerType(Type t) {
17-
t instanceof PointerType or
18-
t instanceof ArrayType
19-
}
20-
21-
private Type baseType(Type t) {
22-
(
23-
exists (PointerType dt
24-
| dt = t.getUnspecifiedType() and
25-
result = dt.getBaseType().getUnspecifiedType()) or
26-
exists (ArrayType at
27-
| at = t.getUnspecifiedType() and
28-
(not at.getBaseType().getUnspecifiedType() instanceof ArrayType) and
29-
result = at.getBaseType().getUnspecifiedType()) or
30-
exists (ArrayType at, ArrayType at2
31-
| at = t.getUnspecifiedType() and
32-
at2 = at.getBaseType().getUnspecifiedType() and
33-
result = baseType(at2))
34-
)
35-
// Make sure that the type has a size and that it isn't ambiguous.
36-
and strictcount(result.getSize()) = 1
37-
}
38-
39-
/**
40-
* Holds if there is a pointer expression with type `sourceType` at
41-
* location `sourceLoc` which might be the source expression for `use`.
42-
*
43-
* For example, with
44-
* ```
45-
* int intArray[5] = { 1, 2, 3, 4, 5 };
46-
* char *charPointer = (char *)intArray;
47-
* return *(charPointer + i);
48-
* ```
49-
* the array initializer on the first line is a source expression
50-
* for the use of `charPointer` on the third line.
51-
*
52-
* The source will either be an `Expr` or a `Parameter`.
53-
*/
54-
private
55-
predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
56-
// Reaching definitions.
57-
if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
58-
exists (SsaDefinition def, LocalScopeVariable v
59-
| use = def.getAUse(v)
60-
| defSourceType(def, v, sourceType, sourceLoc))
61-
62-
// Pointer arithmetic
63-
else if use instanceof PointerAddExpr then
64-
exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
65-
else if use instanceof PointerSubExpr then
66-
exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
67-
else if use instanceof AddExpr then
68-
exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
69-
else if use instanceof SubExpr then
70-
exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
71-
else if use instanceof CrementOperation then
72-
exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
73-
74-
// Conversions are not in the AST, so ignore them.
75-
else if use instanceof Conversion then
76-
none()
77-
78-
// Source expressions
79-
else
80-
(sourceType = use.getType().getUnspecifiedType() and
81-
isPointerType(sourceType) and
82-
sourceLoc = use.getLocation())
83-
}
84-
85-
/**
86-
* Holds if there is a pointer expression with type `sourceType` at
87-
* location `sourceLoc` which might define the value of `v` at `def`.
88-
*/
89-
private
90-
predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
91-
Type sourceType, Location sourceLoc) {
92-
exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
93-
or
94-
defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
95-
or
96-
exists (Parameter p
97-
| p = v and
98-
def.definedByParameter(p) and
99-
sourceType = p.getType().getUnspecifiedType() and
100-
strictcount(p.getType()) = 1 and
101-
isPointerType(sourceType) and
102-
sourceLoc = p.getLocation())
103-
}
104-
105-
/**
106-
* Gets the pointer arithmetic expression that `e` is (directly) used
107-
* in, if any.
108-
*
109-
* For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
110-
*/
111-
private Expr pointerArithmeticParent(Expr e) {
112-
e = result.(PointerAddExpr).getLeftOperand() or
113-
e = result.(PointerSubExpr).getLeftOperand() or
114-
e = result.(PointerDiffExpr).getAnOperand()
115-
}
116-
11714
from Expr dest, Type destType, Type sourceType, Type sourceBase,
11815
Type destBase, Location sourceLoc
11916
where exists(pointerArithmeticParent(dest))

‎cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingChar.ql‎

Lines changed: 0 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -9,103 +9,8 @@
99
* @tags security
1010
* external/cwe/cwe-468
1111
*/
12-
import cpp
13-
import semmle.code.cpp.controlflow.SSA
1412
import IncorrectPointerScalingCommon
1513

16-
private predicate isPointerType(Type t) {
17-
t instanceof PointerType or
18-
t instanceof ArrayType
19-
}
20-
21-
private Type baseType(Type t) {
22-
exists (DerivedType dt
23-
| dt = t.getUnspecifiedType() and
24-
isPointerType(dt) and
25-
result = dt.getBaseType().getUnspecifiedType())
26-
27-
// Make sure that the type has a size and that it isn't ambiguous.
28-
and strictcount(result.getSize()) = 1
29-
}
30-
31-
/**
32-
* Holds if there is a pointer expression with type `sourceType` at
33-
* location `sourceLoc` which might be the source expression for `use`.
34-
*
35-
* For example, with
36-
* ```
37-
* int intArray[5] = { 1, 2, 3, 4, 5 };
38-
* char *charPointer = (char *)intArray;
39-
* return *(charPointer + i);
40-
* ```
41-
* the array initializer on the first line is a source expression
42-
* for the use of `charPointer` on the third line.
43-
*
44-
* The source will either be an `Expr` or a `Parameter`.
45-
*/
46-
private
47-
predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
48-
// Reaching definitions.
49-
if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
50-
exists (SsaDefinition def, LocalScopeVariable v
51-
| use = def.getAUse(v)
52-
| defSourceType(def, v, sourceType, sourceLoc))
53-
54-
// Pointer arithmetic
55-
else if use instanceof PointerAddExpr then
56-
exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
57-
else if use instanceof PointerSubExpr then
58-
exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
59-
else if use instanceof AddExpr then
60-
exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
61-
else if use instanceof SubExpr then
62-
exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
63-
else if use instanceof CrementOperation then
64-
exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
65-
66-
// Conversions are not in the AST, so ignore them.
67-
else if use instanceof Conversion then
68-
none()
69-
70-
// Source expressions
71-
else
72-
(sourceType = use.getType().getUnspecifiedType() and
73-
isPointerType(sourceType) and
74-
sourceLoc = use.getLocation())
75-
}
76-
77-
/**
78-
* Holds if there is a pointer expression with type `sourceType` at
79-
* location `sourceLoc` which might define the value of `v` at `def`.
80-
*/
81-
private
82-
predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
83-
Type sourceType, Location sourceLoc) {
84-
exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
85-
or
86-
defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
87-
or
88-
exists (Parameter p
89-
| p = v and
90-
def.definedByParameter(p) and
91-
sourceType = p.getType().getUnspecifiedType() and
92-
strictcount(p.getType()) = 1 and
93-
isPointerType(sourceType) and
94-
sourceLoc = p.getLocation())
95-
}
96-
97-
/**
98-
* Gets the pointer arithmetic expression that `e` is (directly) used
99-
* in, if any.
100-
*
101-
* For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
102-
*/
103-
private Expr pointerArithmeticParent(Expr e) {
104-
e = result.(PointerAddExpr).getLeftOperand() or
105-
e = result.(PointerSubExpr).getLeftOperand() or
106-
e = result.(PointerDiffExpr).getAnOperand()
107-
}
108-
10914
from Expr dest, Type destType, Type sourceType, Type sourceBase,
11015
Type destBase, Location sourceLoc
11116
where exists(pointerArithmeticParent(dest))

‎cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingCommon.qll‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,3 +46,109 @@ predicate addWithSizeof(Expr e, Expr sizeofExpr, Type sizeofParam) {
4646
| e = subExpr.getLeftOperand() and
4747
multiplyWithSizeof(subExpr.getRightOperand(), sizeofExpr, sizeofParam))
4848
}
49+
50+
/**
51+
* Holds if `t` is a pointer or array type.
52+
*/
53+
predicate isPointerType(Type t) {
54+
t instanceof PointerType or
55+
t instanceof ArrayType
56+
}
57+
58+
/**
59+
* Gets the base type of a pointer or array type. In the case of an array of
60+
* arrays, the inner base type is returned.
61+
*/
62+
Type baseType(Type t) {
63+
(
64+
exists (PointerType dt
65+
| dt = t.getUnspecifiedType() and
66+
result = dt.getBaseType().getUnspecifiedType()) or
67+
exists (ArrayType at
68+
| at = t.getUnspecifiedType() and
69+
(not at.getBaseType().getUnspecifiedType() instanceof ArrayType) and
70+
result = at.getBaseType().getUnspecifiedType()) or
71+
exists (ArrayType at, ArrayType at2
72+
| at = t.getUnspecifiedType() and
73+
at2 = at.getBaseType().getUnspecifiedType() and
74+
result = baseType(at2))
75+
)
76+
// Make sure that the type has a size and that it isn't ambiguous.
77+
and strictcount(result.getSize()) = 1
78+
}
79+
80+
/**
81+
* Holds if there is a pointer expression with type `sourceType` at
82+
* location `sourceLoc` which might be the source expression for `use`.
83+
*
84+
* For example, with
85+
* ```
86+
* int intArray[5] = { 1, 2, 3, 4, 5 };
87+
* char *charPointer = (char *)intArray;
88+
* return *(charPointer + i);
89+
* ```
90+
* the array initializer on the first line is a source expression
91+
* for the use of `charPointer` on the third line.
92+
*
93+
* The source will either be an `Expr` or a `Parameter`.
94+
*/
95+
predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
96+
// Reaching definitions.
97+
if exists (SsaDefinition def, LocalScopeVariable v | use = def.getAUse(v)) then
98+
exists (SsaDefinition def, LocalScopeVariable v
99+
| use = def.getAUse(v)
100+
| defSourceType(def, v, sourceType, sourceLoc))
101+
102+
// Pointer arithmetic
103+
else if use instanceof PointerAddExpr then
104+
exprSourceType(use.(PointerAddExpr).getLeftOperand(), sourceType, sourceLoc)
105+
else if use instanceof PointerSubExpr then
106+
exprSourceType(use.(PointerSubExpr).getLeftOperand(), sourceType, sourceLoc)
107+
else if use instanceof AddExpr then
108+
exprSourceType(use.(AddExpr).getAnOperand(), sourceType, sourceLoc)
109+
else if use instanceof SubExpr then
110+
exprSourceType(use.(SubExpr).getAnOperand(), sourceType, sourceLoc)
111+
else if use instanceof CrementOperation then
112+
exprSourceType(use.(CrementOperation).getOperand(), sourceType, sourceLoc)
113+
114+
// Conversions are not in the AST, so ignore them.
115+
else if use instanceof Conversion then
116+
none()
117+
118+
// Source expressions
119+
else
120+
(sourceType = use.getType().getUnspecifiedType() and
121+
isPointerType(sourceType) and
122+
sourceLoc = use.getLocation())
123+
}
124+
125+
/**
126+
* Holds if there is a pointer expression with type `sourceType` at
127+
* location `sourceLoc` which might define the value of `v` at `def`.
128+
*/
129+
predicate defSourceType(SsaDefinition def, LocalScopeVariable v,
130+
Type sourceType, Location sourceLoc) {
131+
exprSourceType(def.getDefiningValue(v), sourceType, sourceLoc)
132+
or
133+
defSourceType(def.getAPhiInput(v), v, sourceType, sourceLoc)
134+
or
135+
exists (Parameter p
136+
| p = v and
137+
def.definedByParameter(p) and
138+
sourceType = p.getType().getUnspecifiedType() and
139+
strictcount(p.getType()) = 1 and
140+
isPointerType(sourceType) and
141+
sourceLoc = p.getLocation())
142+
}
143+
144+
/**
145+
* Gets the pointer arithmetic expression that `e` is (directly) used
146+
* in, if any.
147+
*
148+
* For example, in `(char*)(p + 1)`, for `p`, ths result is `p + 1`.
149+
*/
150+
Expr pointerArithmeticParent(Expr e) {
151+
e = result.(PointerAddExpr).getLeftOperand() or
152+
e = result.(PointerSubExpr).getLeftOperand() or
153+
e = result.(PointerDiffExpr).getAnOperand()
154+
}

0 commit comments

Comments
 (0)