C++: Rewrite `cpp/constant-array-overflow` and add barriers #13669

MathiasVP · 2023-07-05T15:45:26Z

This PR splits the dataflow traversals in cpp/constant-array-overflow into multiple stages so that we can track the ArrayType as a flow state without introducing a cartesian product, and then adds a barrier that blocks flow in cases such as:

void foo(unsigned char* p, unsigned n) {
  if(n < 10) {
    unsigned char q = p[n]; // This is safe because the index is guarded to be less than 10 which happens to equal the size of buffer in `test`.
  }
}

void test(unsigned n) {
  unsigned char buffer[10];
  foo(buffer, n);
}

The first commit rewrites the query to track the array type as a FlowState, and the second commit adds the barrier that blocks out this flow.

…access to the array as a flow state.

cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql

MathiasVP added 2 commits July 5, 2023 16:39

C++: Rethink the 'cpp/constant-array-overflow' query so that we have …

87d4541

…access to the array as a flow state.

C++: Add barrier.

b412873

github-actions bot added the C++ label Jul 5, 2023

github-code-scanning bot found potential problems Jul 5, 2023

View reviewed changes

MathiasVP added 2 commits July 5, 2023 17:39

C++: Fix Code Scanning errors.

4d7ae7c

C++: Get rid of the expensive 'PointerArithmeticToDeref' configuration.

d59ef18

github-code-scanning bot found potential problems Jul 7, 2023

View reviewed changes

cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql Fixed Show fixed Hide fixed

C++: Fix Code Scanning errors.

daa6db0

C++: Rewrite cpp/constant-array-overflow and add barriers #13669

Are you sure you want to change the base?

C++: Rewrite cpp/constant-array-overflow and add barriers #13669

Conversation

MathiasVP commented Jul 5, 2023

C++: Rewrite `cpp/constant-array-overflow` and add barriers #13669

C++: Rewrite `cpp/constant-array-overflow` and add barriers #13669