Skip to content

Commit 4322a39

Browse files
author
Robert Marsh
committed
C++: fix typo in Overflow.qll abs handling
1 parent 4f23cce commit 4322a39

File tree

2 files changed

+1
-33
lines changed

2 files changed

+1
-33
lines changed

‎cpp/ql/lib/semmle/code/cpp/security/Overflow.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import semmle.code.cpp.controlflow.Guards
1717
predicate guardedAbs(Operation e, Expr use) {
1818
exists(FunctionCall fc | fc.getTarget().getName() = ["abs", "labs", "llabs", "imaxabs"] |
1919
fc.getArgument(0).getAChild*() = use and
20-
exists(GuardCondition c | c.ensuresLt(use, _, _, e.getBasicBlock(), true))
20+
exists(GuardCondition c | c.ensuresLt(fc, _, _, e.getBasicBlock(), true))
2121
)
2222
}
2323

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/ArithmeticTainted.expected‎

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,10 @@ edges
77
| test5.cpp:5:5:5:17 | ReturnValue | test5.cpp:17:6:17:18 | call to getTaintedInt |
88
| test5.cpp:5:5:5:17 | ReturnValue | test5.cpp:17:6:17:18 | call to getTaintedInt |
99
| test5.cpp:5:5:5:17 | ReturnValue | test5.cpp:18:6:18:18 | call to getTaintedInt |
10-
| test5.cpp:5:5:5:17 | ReturnValue | test5.cpp:27:16:27:28 | call to getTaintedInt |
11-
| test5.cpp:5:5:5:17 | ReturnValue | test5.cpp:37:21:37:33 | call to getTaintedInt |
1210
| test5.cpp:9:7:9:9 | buf | test5.cpp:5:5:5:17 | ReturnValue |
1311
| test5.cpp:9:7:9:9 | gets output argument | test5.cpp:5:5:5:17 | ReturnValue |
1412
| test5.cpp:18:6:18:18 | call to getTaintedInt | test5.cpp:19:6:19:6 | y |
1513
| test5.cpp:18:6:18:18 | call to getTaintedInt | test5.cpp:19:6:19:6 | y |
16-
| test5.cpp:27:16:27:28 | call to getTaintedInt | test5.cpp:30:17:30:23 | tainted |
17-
| test5.cpp:27:16:27:28 | call to getTaintedInt | test5.cpp:30:17:30:23 | tainted |
18-
| test5.cpp:27:16:27:28 | call to getTaintedInt | test5.cpp:30:27:30:33 | tainted |
19-
| test5.cpp:27:16:27:28 | call to getTaintedInt | test5.cpp:30:27:30:33 | tainted |
20-
| test5.cpp:37:21:37:33 | call to getTaintedInt | test5.cpp:40:17:40:23 | tainted |
21-
| test5.cpp:37:21:37:33 | call to getTaintedInt | test5.cpp:40:17:40:23 | tainted |
22-
| test5.cpp:37:21:37:33 | call to getTaintedInt | test5.cpp:40:27:40:33 | tainted |
23-
| test5.cpp:37:21:37:33 | call to getTaintedInt | test5.cpp:40:27:40:33 | tainted |
2414
| test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections |
2515
| test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections |
2616
| test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections |
@@ -52,20 +42,6 @@ nodes
5242
| test5.cpp:19:6:19:6 | y | semmle.label | y |
5343
| test5.cpp:19:6:19:6 | y | semmle.label | y |
5444
| test5.cpp:19:6:19:6 | y | semmle.label | y |
55-
| test5.cpp:27:16:27:28 | call to getTaintedInt | semmle.label | call to getTaintedInt |
56-
| test5.cpp:30:17:30:23 | tainted | semmle.label | tainted |
57-
| test5.cpp:30:17:30:23 | tainted | semmle.label | tainted |
58-
| test5.cpp:30:17:30:23 | tainted | semmle.label | tainted |
59-
| test5.cpp:30:27:30:33 | tainted | semmle.label | tainted |
60-
| test5.cpp:30:27:30:33 | tainted | semmle.label | tainted |
61-
| test5.cpp:30:27:30:33 | tainted | semmle.label | tainted |
62-
| test5.cpp:37:21:37:33 | call to getTaintedInt | semmle.label | call to getTaintedInt |
63-
| test5.cpp:40:17:40:23 | tainted | semmle.label | tainted |
64-
| test5.cpp:40:17:40:23 | tainted | semmle.label | tainted |
65-
| test5.cpp:40:17:40:23 | tainted | semmle.label | tainted |
66-
| test5.cpp:40:27:40:33 | tainted | semmle.label | tainted |
67-
| test5.cpp:40:27:40:33 | tainted | semmle.label | tainted |
68-
| test5.cpp:40:27:40:33 | tainted | semmle.label | tainted |
6945
| test.c:11:29:11:32 | argv | semmle.label | argv |
7046
| test.c:11:29:11:32 | argv | semmle.label | argv |
7147
| test.c:14:15:14:28 | maxConnections | semmle.label | maxConnections |
@@ -87,14 +63,6 @@ nodes
8763
| test5.cpp:17:6:17:18 | call to getTaintedInt | test5.cpp:9:7:9:9 | buf | test5.cpp:17:6:17:18 | call to getTaintedInt | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
8864
| test5.cpp:19:6:19:6 | y | test5.cpp:9:7:9:9 | buf | test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
8965
| test5.cpp:19:6:19:6 | y | test5.cpp:9:7:9:9 | buf | test5.cpp:19:6:19:6 | y | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
90-
| test5.cpp:30:17:30:23 | tainted | test5.cpp:9:7:9:9 | buf | test5.cpp:30:17:30:23 | tainted | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
91-
| test5.cpp:30:17:30:23 | tainted | test5.cpp:9:7:9:9 | buf | test5.cpp:30:17:30:23 | tainted | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
92-
| test5.cpp:30:27:30:33 | tainted | test5.cpp:9:7:9:9 | buf | test5.cpp:30:27:30:33 | tainted | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
93-
| test5.cpp:30:27:30:33 | tainted | test5.cpp:9:7:9:9 | buf | test5.cpp:30:27:30:33 | tainted | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
94-
| test5.cpp:40:17:40:23 | tainted | test5.cpp:9:7:9:9 | buf | test5.cpp:40:17:40:23 | tainted | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
95-
| test5.cpp:40:17:40:23 | tainted | test5.cpp:9:7:9:9 | buf | test5.cpp:40:17:40:23 | tainted | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
96-
| test5.cpp:40:27:40:33 | tainted | test5.cpp:9:7:9:9 | buf | test5.cpp:40:27:40:33 | tainted | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
97-
| test5.cpp:40:27:40:33 | tainted | test5.cpp:9:7:9:9 | buf | test5.cpp:40:27:40:33 | tainted | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test5.cpp:9:7:9:9 | buf | User-provided value |
9866
| test.c:14:15:14:28 | maxConnections | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | $@ flows to here and is used in arithmetic, potentially causing an overflow. | test.c:11:29:11:32 | argv | User-provided value |
9967
| test.c:14:15:14:28 | maxConnections | test.c:11:29:11:32 | argv | test.c:14:15:14:28 | maxConnections | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:11:29:11:32 | argv | User-provided value |
10068
| test.c:44:7:44:10 | len2 | test.c:41:17:41:20 | argv | test.c:44:7:44:10 | len2 | $@ flows to here and is used in arithmetic, potentially causing an underflow. | test.c:41:17:41:20 | argv | User-provided value |

0 commit comments

Comments
 (0)