Compiler optimization will exclude the cleaning of private information.
+Using the memset function to clear private data as a final expression when working with a variable is potentially dangerous, since the compiler can optimize this call.
+For some compilers, optimization is also possible when using calls to free memory after the memset function.
It is possible to miss detection of vulnerabilities if used to clear fields of structures or parts of a buffer.
+ +We recommend to use the RtlSecureZeroMemory or memset_s functions, or compilation flags that exclude optimization of memset calls (-fno-builtin-memset).
The following example demonstrates an erroneous and corrected use of the memset function.
memset the function to clear private data in a variable that has no subsequent use
+ * is potentially dangerous because the compiler can remove the call.
* @kind problem
* @id cpp/compiler-removal-of-code-to-clear-buffers
* @problem.severity warning
From 9e3b288f3374c6da4e8e2fb81ed40ee155642692 Mon Sep 17 00:00:00 2001
From: ihsinme <61293369+ihsinme@users.noreply.github.com>
Date: Thu, 14 Jan 2021 17:16:21 +0300
Subject: [PATCH 05/18] Update
cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.c
Co-authored-by: Mathias Vorreiter Pedersen Compiler optimization will exclude the cleaning of private information.
-Using the memset function to clear private data as a final expression when working with a variable is potentially dangerous, since the compiler can optimize this call.
+Using the memset function to clear private data in a variable that has no subsequent use is potentially dangerous, since the compiler can remove the call.
For some compilers, optimization is also possible when using calls to free memory after the memset function.
It is possible to miss detection of vulnerabilities if used to clear fields of structures or parts of a buffer.
From 7f5e5fcb99b309c296b3d3140b5b9b3cd0eb7490 Mon Sep 17 00:00:00 2001 From: ihsinme <61293369+ihsinme@users.noreply.github.com> Date: Thu, 14 Jan 2021 17:19:57 +0300 Subject: [PATCH 11/18] Update cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.qhelp Co-authored-by: Mathias Vorreiter PedersenWe recommend to use the RtlSecureZeroMemory or memset_s functions, or compilation flags that exclude optimization of memset calls (-fno-builtin-memset).
We recommend to use the RtlSecureZeroMemory or memset_s functions, or compilation flags that exclude optimization of memset calls (e.g. -fno-builtin-memset).
Compiler optimization will exclude the cleaning of private information.
Using the memset function to clear private data in a variable that has no subsequent use is potentially dangerous, since the compiler can remove the call.
-For some compilers, optimization is also possible when using calls to free memory after the memset function.
memset function.
It is possible to miss detection of vulnerabilities if used to clear fields of structures or parts of a buffer.
From 4c9de4574a9169f51428dbc02b280b216cbdb5c7 Mon Sep 17 00:00:00 2001 From: ihsinme <61293369+ihsinme@users.noreply.github.com> Date: Wed, 20 Jan 2021 16:24:43 +0300 Subject: [PATCH 16/18] Update CompilerRemovalOfCodeToClearBuffers.ql --- .../Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql | 3 +++ 1 file changed, 3 insertions(+) diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql index 96ecc30a95ef..b0c412df4cca 100644 --- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql +++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql @@ -12,6 +12,7 @@ import cpp import semmle.code.cpp.dataflow.DataFlow +import semmle.code.cpp.dataflow.StackAddress /** * A call to `memset` of the form `memset(ptr, value, num)`, for some local variable `ptr`. @@ -34,6 +35,8 @@ class CompilerRemovaMemset extends FunctionCall { this.getArgument(0) = v.getAnAccess() and alloc.getASuccessor+() = this ) + or + not stackPointerFlowsToUse(this.getArgument(0), _, _, _) } predicate isExistsFreeForThisVariable() { From 9c53e39394939674b49750af8ce28c2c7d680ccb Mon Sep 17 00:00:00 2001 From: ihsinme <61293369+ihsinme@users.noreply.github.com> Date: Thu, 21 Jan 2021 16:52:00 +0300 Subject: [PATCH 17/18] Update CompilerRemovalOfCodeToClearBuffers.ql --- .../CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql index b0c412df4cca..435d2f8f96aa 100644 --- a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql +++ b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql @@ -23,7 +23,12 @@ class CompilerRemovaMemset extends FunctionCall { exists(DataFlow::Node source, DataFlow::Node sink, LocalVariable isv, Expr exp | DataFlow::localFlow(source, sink) and this.getArgument(0) = isv.getAnAccess() and - source.asExpr() = exp and + ( + source.asExpr() = exp + or + // handle the case where exp is defined by an address being passed into some function. + source.asDefiningArgument() = exp + ) and exp.getLocation().getEndLine() < this.getArgument(0).getLocation().getStartLine() and sink.asExpr() = this.getArgument(0) ) From 416aa49d99c55bf141509d9ff275a10f70dffb87 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen