Skip to content

Commit a1aed1a

Browse files
committed
C++: Workaround for problem with memcpy flow
The type of the source argument to `memcpy` is `void *`, and somehow that meant that the copied object itself got type `void`. Since that has size 0, the SSA construction did not model it as reading from the last write. This is probably not the right fix, but maybe it's good enough for now. The right fix would ensure that the type reported by `hasOperandMemoryAccess` is `UnknownType`. When `DefaultTaintTracking.qll` is enabled, this commit has the effect of restoring a lost results: --- a/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.expected +++ b/cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/OverflowDestination.expected @@ -1 +1,2 @@ | overflowdestination.cpp:30:2:30:8 | call to strncpy | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. | +| overflowdestination.cpp:46:2:46:7 | call to memcpy | To avoid overflow, this operation should be bounded by destination-buffer size, not source-buffer size. |
1 parent 72fddaf commit a1aed1a

File tree

1 file changed

+2
-2
lines changed
  • cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal

1 file changed

+2
-2
lines changed

cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ private predicate hasResultMemoryAccess(
2626
type = languageType.getIRType() and
2727
isIndirectOrBufferMemoryAccess(instr.getResultMemoryAccess()) and
2828
(if instr.hasResultMayMemoryAccess() then isMayAccess = true else isMayAccess = false) and
29-
if exists(type.getByteSize())
29+
if type.getByteSize() > 0
3030
then endBitOffset = Ints::add(startBitOffset, Ints::mul(type.getByteSize(), 8))
3131
else endBitOffset = Ints::unknown()
3232
)
@@ -43,7 +43,7 @@ private predicate hasOperandMemoryAccess(
4343
type = languageType.getIRType() and
4444
isIndirectOrBufferMemoryAccess(operand.getMemoryAccess()) and
4545
(if operand.hasMayReadMemoryAccess() then isMayAccess = true else isMayAccess = false) and
46-
if exists(type.getByteSize())
46+
if type.getByteSize() > 0
4747
then endBitOffset = Ints::add(startBitOffset, Ints::mul(type.getByteSize(), 8))
4848
else endBitOffset = Ints::unknown()
4949
)

0 commit comments

Comments
 (0)