Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,9 @@ class ExplicitComparison extends EffectivelyComparison, FinalComparisonOperation

class ImplicitComparison extends EffectivelyComparison, GuardCondition instanceof Expr {
ImplicitComparison() {
this.valueControlsEdge(_, _, _) and
this instanceof FunctionExpr and
not getParent() instanceof ComparisonOperation
not super.getParent() instanceof ComparisonOperation
}

override string getExplanation() { result = "$@ undergoes implicit constant comparison." }
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ from InterestingOverflowingOperation e
where
not isExcluded(e, IntegerConversionPackage::integerExpressionLeadToDataLossQuery()) and
// Not within a guard condition
not exists(GuardCondition gc | gc.getAChild*() = e) and
not e.getParent*().(GuardCondition).valueControlsEdge(_, _, _) and
// Not guarded by a check, where the check is not an invalid overflow check
not e.hasValidPreCheck() and
// Covered by `IntMultToLong.ql` instead
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -62,8 +62,13 @@ class NoThrowAllocExprWrapperFunction extends Function {
NoThrowAllocExprWrapperFunction() {
n.getEnclosingFunction() = this and
DataFlow::localExprFlow(n, any(ReturnStmt rs).getExpr()) and
// Not checked in this wrapper function
not exists(GuardCondition gc | DataFlow::localExprFlow(n, gc.(Expr).getAChild*()))
// Not checked in this wrapper function. That is, the allocation is not a
// guard condition which guards something inside the function.
not exists(BasicBlock bb |
pragma[only_bind_out](bb.getEnclosingFunction()) =
pragma[only_bind_out](n.getEnclosingFunction()) and
n.(GuardCondition).valueControlsEdge(bb, _, _)
)
}

/** Gets the underlying nothrow allocation ultimately being wrapped. */
Expand All @@ -84,7 +89,9 @@ module NoThrowNewErrorCheckConfig implements DataFlow::ConfigSig {
source.asExpr() instanceof NotWrappedNoThrowAllocExpr
}

predicate isSink(DataFlow::Node sink) { sink.asExpr() = any(GuardCondition gc).getAChild*() }
predicate isSink(DataFlow::Node sink) {
sink.asExpr().(GuardCondition).valueControlsEdge(_, _, _)
}
}

module NoThrowNewErrorCheckFlow = DataFlow::Global<NoThrowNewErrorCheckConfig>;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,8 @@
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:64,5-13)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:66,36-44)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:82,46-54)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:83,22-30)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:87,20-28)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:90,35-43)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:95,38-46)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:86,46-54)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:87,22-30)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:91,20-28)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:96,35-43)
WARNING: module 'DataFlow' has been deprecated and may be removed in future (DetectAndHandleMemoryAllocationErrors.ql:101,38-46)
| test.cpp:24:7:24:34 | new | nothrow new allocation of $@ returns here without a subsequent check to see whether the pointer is valid. | test.cpp:24:7:24:34 | new | StructA * |
| test.cpp:40:17:40:38 | call to allocate_without_check | nothrow new allocation of $@ returns here without a subsequent check to see whether the pointer is valid. | test.cpp:35:17:35:44 | new | StructA * |
Original file line number Diff line number Diff line change
Expand Up @@ -55,8 +55,6 @@ query predicate problems(FunctionCall fc, string message) {
"vwprintf", "vfwprintf", "vswprintf", "vwprintf_s", "vfwprintf_s", "vswprintf_s",
"vsnwprintf_s"
]) and
not exists(GuardCondition gc |
DataFlow::localFlow(DataFlow::exprNode(fc), DataFlow::exprNode(gc.(Expr).getAChild*()))
) and
not fc.(GuardCondition).valueControlsEdge(_, _, _) and
message = "Return value from " + fc.getTarget().getName() + " is not tested for errors."
}
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ query predicate problems(InterestingOverflowingOperation op, string message) {
not isExcluded(op, getQuery()) and
op.getType().getUnderlyingType().(IntegralType).isUnsigned() and
// Not within a guard condition
not exists(GuardCondition gc | gc.getAChild*() = op) and
not op.getParent*().(GuardCondition).valueControlsEdge(_, _, _) and
// Not guarded by a check, where the check is not an invalid overflow check
not op.hasValidPreCheck() and
// Is not checked after the operation
Expand Down
Loading