Skip to content

Commit ca07311

Browse files
mbaludambaluda
committed
STR32-C STR38-C:
- removed links to library internals - documented false positives due to extractor errors
1 parent 8f35e45 commit ca07311

9 files changed

+170
-23
lines changed

‎c/cert/src/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.ql

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,5 @@ where
6363
c instanceof WideToNarrowCast and actual = "wide" and expected = "narrow"
6464
)
6565
select call,
66-
"Call to function $@ with a " + actual + " character string $@ where a " + expected +
67-
" character string $@ is expected.", call.getTarget(), call.getTarget().getName(), arg,
68-
"argument", p, "parameter"
66+
"Call to function `" + call.getTarget().getName() + "` with a " + actual +
67+
" character string $@ where a " + expected + " character string is expected.", arg, "argument"

‎c/cert/test/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.expected.qcc

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
| test.c:19:3:19:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:7:20:7:24 | Co | this expression |
2+
| test.c:20:3:20:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:7:20:7:24 | Co | this expression |
3+
| test.c:22:3:22:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:13:3:13:9 | call to strncpy | this expression |
4+
| test.c:23:3:23:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:13:3:13:9 | call to strncpy | this expression |
5+
| test.c:24:3:24:8 | call to strlen | String modified by $@ is passed to function expecting a null-terminated string. | test.c:13:3:13:9 | call to strncpy | this expression |
6+
| test.c:46:3:46:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:41:3:41:10 | call to snprintf | this expression |
7+
| test.c:47:3:47:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:41:3:41:10 | call to snprintf | this expression |
8+
| test.c:55:3:55:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:53:3:53:9 | call to strncat | this expression |
9+
| test.c:56:3:56:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:53:3:53:9 | call to strncat | this expression |
10+
| test.c:62:3:62:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:60:20:60:24 | Co | this expression |
11+
| test.c:63:3:63:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:60:20:60:24 | Co | this expression |
12+
| test.c:75:3:75:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:72:20:72:24 | Co | this expression |
13+
| test.c:76:3:76:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:72:20:72:24 | Co | this expression |
14+
| test.c:85:3:85:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:83:3:83:9 | call to strncpy | this expression |
15+
| test.c:86:3:86:8 | call to printf | String modified by $@ is passed to function expecting a null-terminated string. | test.c:83:3:83:9 | call to strncpy | this expression |

‎c/cert/test/rules/STR32-C/test.c.qcc

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#include <stdio.h>
2+
#include <string.h>
3+
#include <wchar.h>
4+
5+
void f1() {
6+
char a1_nt[7] = "CodeQL"; // is null terminated
7+
char a1_nnt[3] = "Cod"; // is NOT null termianted
8+
9+
char a1[9];
10+
char a2[10];
11+
char a9[10];
12+
13+
strncpy(a2, a1, 5); // not null terminated because n < length(src)
14+
strncpy(a9, a1, 10); // is null terminated; n > length(src)
15+
16+
printf("%s", a1_nt); // COMPLIANT
17+
printf(a1_nt); // COMPLIANT
18+
19+
printf("%s", a1_nnt); // NON_COMPLIANT
20+
printf(a1_nnt); // NON_COMPLIANT
21+
22+
printf("%s", a2); // NON_COMPLIANT
23+
printf(a2); // NON_COMPLIANT
24+
strlen(a2); // NON_COMPLIANT
25+
26+
printf(a9); // COMPLIANT
27+
printf(a9); // COMPLIANT
28+
29+
wchar_t wa1_nt[7] = L"CodeQL"; // is null terminated
30+
wchar_t wa1_nnt[3] = L"Cod"; // is NOT null termianted
31+
wprintf(wa1_nt); // COMPLIANT
32+
// FALSE_NEGATIVES due to https://github.com/github/codeql/issues/12914
33+
wprintf(wa1_nnt); // NON_COMPLIANT[FALSE_NEGATIVE]
34+
}
35+
36+
void f2() {
37+
char a1[10];
38+
char a2[10];
39+
40+
snprintf(a1, 10, "CodeQL %d", 3); // will be null terminated
41+
snprintf(a2, 11, "CodeQL %d", 3); // will not be null terminated
42+
43+
printf("%s", a1); // COMPLIANT
44+
printf(a1); // COMPLIANT
45+
46+
printf("%s", a2); // NON_COMPLIANT
47+
printf(a2); // NON_COMPLIANT
48+
}
49+
50+
void f3() {
51+
char a1[2];
52+
53+
strncat(a1, "CodeQL", 5); // will not be null terminated
54+
55+
printf(a1); // NON_COMPLIANT
56+
printf("%s", a1); // NON_COMPLIANT
57+
}
58+
59+
void f4() {
60+
char a1_nnt[3] = "Cod"; // is NOT null termianted
61+
62+
printf("%s", a1_nnt); // NON_COMPLIANT
63+
printf(a1_nnt); // NON_COMPLIANT
64+
65+
a1_nnt[2] = '\0';
66+
67+
printf("%s", a1_nnt); // COMPLIANT
68+
printf(a1_nnt); // COMPLIANT
69+
}
70+
71+
f5() {
72+
char a1_nnt[3] = "Cod"; // is NOT null termianted
73+
char a2[10] = "CodeQL";
74+
75+
printf("%s", a1_nnt); // NON_COMPLIANT
76+
printf(a1_nnt); // NON_COMPLIANT
77+
78+
a1_nnt[2] = '\0';
79+
80+
printf("%s", a1_nnt); // COMPLIANT
81+
printf(a1_nnt); // COMPLIANT
82+
83+
strncpy(a1_nnt, a2, 1); // not null terminated because n < length(src)
84+
85+
printf("%s", a1_nnt); // NON_COMPLIANT
86+
printf(a1_nnt); // NON_COMPLIANT
87+
}

‎c/cert/test/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.expected

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
| test.c:15:3:15:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string $@ is expected. | test.c:6:7:6:13 | strncpy | strncpy | test.c:15:11:15:12 | w2 | argument | test.c:6:15:6:18 | (unnamed parameter 0) | parameter |
2-
| test.c:15:3:15:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string $@ is expected. | test.c:6:7:6:13 | strncpy | strncpy | test.c:15:15:15:16 | w1 | argument | test.c:6:33:6:42 | (unnamed parameter 1) | parameter |
3-
| test.c:16:3:16:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string $@ is expected. | test.c:6:7:6:13 | strncpy | strncpy | test.c:16:11:16:12 | w2 | argument | test.c:6:15:6:18 | (unnamed parameter 0) | parameter |
4-
| test.c:26:3:26:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string $@ is expected. | test.c:7:10:7:16 | wcsncpy | wcsncpy | test.c:26:11:26:12 | n2 | argument | test.c:7:18:7:24 | (unnamed parameter 0) | parameter |
5-
| test.c:26:3:26:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string $@ is expected. | test.c:7:10:7:16 | wcsncpy | wcsncpy | test.c:26:15:26:16 | n1 | argument | test.c:7:45:7:51 | (unnamed parameter 1) | parameter |
6-
| test.c:27:3:27:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string $@ is expected. | test.c:7:10:7:16 | wcsncpy | wcsncpy | test.c:27:15:27:16 | n1 | argument | test.c:7:45:7:51 | (unnamed parameter 1) | parameter |
7-
| test.c:32:3:32:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string $@ is expected. | test.c:6:7:6:13 | strncpy | strncpy | test.c:32:11:32:12 | w2 | argument | test.c:6:15:6:18 | (unnamed parameter 0) | parameter |
8-
| test.c:32:3:32:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string $@ is expected. | test.c:6:7:6:13 | strncpy | strncpy | test.c:32:15:32:16 | w1 | argument | test.c:6:33:6:42 | (unnamed parameter 1) | parameter |
9-
| test.c:33:3:33:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string $@ is expected. | test.c:6:7:6:13 | strncpy | strncpy | test.c:33:11:33:12 | w2 | argument | test.c:6:15:6:18 | (unnamed parameter 0) | parameter |
10-
| test.c:36:3:36:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string $@ is expected. | test.c:7:10:7:16 | wcsncpy | wcsncpy | test.c:36:11:36:12 | n2 | argument | test.c:7:18:7:24 | (unnamed parameter 0) | parameter |
11-
| test.c:36:3:36:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string $@ is expected. | test.c:7:10:7:16 | wcsncpy | wcsncpy | test.c:36:15:36:16 | n1 | argument | test.c:7:45:7:51 | (unnamed parameter 1) | parameter |
12-
| test.c:37:3:37:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string $@ is expected. | test.c:7:10:7:16 | wcsncpy | wcsncpy | test.c:37:15:37:16 | n1 | argument | test.c:7:45:7:51 | (unnamed parameter 1) | parameter |
1+
| test.c:11:3:11:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:11:3:11:9 | call to strncpy | strncpy | test.c:11:11:11:12 | w2 | argument |
2+
| test.c:11:3:11:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:11:3:11:9 | call to strncpy | strncpy | test.c:11:15:11:16 | w1 | argument |
3+
| test.c:12:3:12:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:12:3:12:9 | call to strncpy | strncpy | test.c:12:11:12:12 | w2 | argument |
4+
| test.c:22:3:22:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:22:3:22:9 | call to wcsncpy | wcsncpy | test.c:22:11:22:12 | n2 | argument |
5+
| test.c:22:3:22:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:22:3:22:9 | call to wcsncpy | wcsncpy | test.c:22:15:22:16 | n1 | argument |
6+
| test.c:23:3:23:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:23:3:23:9 | call to wcsncpy | wcsncpy | test.c:23:15:23:16 | n1 | argument |
7+
| test.c:28:3:28:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:28:3:28:9 | call to strncpy | strncpy | test.c:28:11:28:12 | w2 | argument |
8+
| test.c:28:3:28:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:28:3:28:9 | call to strncpy | strncpy | test.c:28:15:28:16 | w1 | argument |
9+
| test.c:29:3:29:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:29:3:29:9 | call to strncpy | strncpy | test.c:29:11:29:12 | w2 | argument |
10+
| test.c:32:3:32:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:32:3:32:9 | call to wcsncpy | wcsncpy | test.c:32:11:32:12 | n2 | argument |
11+
| test.c:32:3:32:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:32:3:32:9 | call to wcsncpy | wcsncpy | test.c:32:15:32:16 | n1 | argument |
12+
| test.c:33:3:33:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:33:3:33:9 | call to wcsncpy | wcsncpy | test.c:33:15:33:16 | n1 | argument |

‎c/cert/test/rules/STR38-C/DoNotConfuseNarrowAndWideFunctions.expected.qcc

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
| test.c:22:3:22:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:22:3:22:9 | call to wcsncpy | wcsncpy | test.c:22:11:22:12 | n2 | argument |
2+
| test.c:22:3:22:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:22:3:22:9 | call to wcsncpy | wcsncpy | test.c:22:15:22:16 | n1 | argument |
3+
| test.c:23:3:23:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:23:3:23:9 | call to wcsncpy | wcsncpy | test.c:23:15:23:16 | n1 | argument |
4+
| test.c:28:3:28:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:28:3:28:9 | call to strncpy | strncpy | test.c:28:11:28:12 | w2 | argument |
5+
| test.c:28:3:28:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:28:3:28:9 | call to strncpy | strncpy | test.c:28:15:28:16 | w1 | argument |
6+
| test.c:29:3:29:9 | call to strncpy | Call to function $@ with a wide character string $@ where a narrow character string parameter is expected. | test.c:29:3:29:9 | call to strncpy | strncpy | test.c:29:11:29:12 | w2 | argument |
7+
| test.c:32:3:32:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:32:3:32:9 | call to wcsncpy | wcsncpy | test.c:32:11:32:12 | n2 | argument |
8+
| test.c:32:3:32:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:32:3:32:9 | call to wcsncpy | wcsncpy | test.c:32:15:32:16 | n1 | argument |
9+
| test.c:33:3:33:9 | call to wcsncpy | Call to function $@ with a narrow character string $@ where a wide character string parameter is expected. | test.c:33:3:33:9 | call to wcsncpy | wcsncpy | test.c:33:15:33:16 | n1 | argument |

‎c/cert/test/rules/STR38-C/copy.c.qcc

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#include <stddef.h>
2+
#include <string.h>
3+
#include <wchar.h>
4+
5+
void f1() {
6+
wchar_t w1[] = L"codeql";
7+
wchar_t w2[] = L"codeql";
8+
char n1[] = "codeql";
9+
char n2[] = "codeql";
10+
// FALSE_NEGATIVES due to https://github.com/github/codeql/issues/12914
11+
strncpy(w2, w1, 1); // NON_COMPLIANT[FALSE_NEGATIVE] (2x)
12+
strncpy(w2, n1, 1); // NON_COMPLIANT[FALSE_NEGATIVE] (1x)
13+
strncpy(n2, n1, 1); // COMPLIANT
14+
}
15+
16+
void f2() {
17+
wchar_t w1[] = L"codeql";
18+
wchar_t w2[] = L"codeql";
19+
char n1[] = "codeql";
20+
char n2[] = "codeql";
21+
22+
wcsncpy(n2, n1, 1); // NON_COMPLIANT (2x)
23+
wcsncpy(w2, n1, 1); // NON_COMPLIANT (1x)
24+
wcsncpy(w2, w1, 1); // COMPLIANT
25+
}
26+
27+
void f3(wchar_t *w1, wchar_t *w2, char *n1, char *n2) {
28+
strncpy(w2, w1, 1); // NON_COMPLIANT (2x)
29+
strncpy(w2, n1, 1); // NON_COMPLIANT (1x)
30+
strncpy(n2, n1, 1); // COMPLIANT
31+
32+
wcsncpy(n2, n1, 1); // NON_COMPLIANT (2x)
33+
wcsncpy(w2, n1, 1); // NON_COMPLIANT (1x)
34+
wcsncpy(w2, w1, 1); // COMPLIANT
35+
}

‎c/cert/test/rules/STR38-C/test.c

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
11
#include <stddef.h>
2-
3-
// defined in <string.h> and <wchar.h> but we get absolute
4-
// paths using the current alert so they are defined here.
5-
// to prevent absolute paths from being generated.
6-
char *strncpy(char *__restrict, const char *__restrict, size_t);
7-
wchar_t *wcsncpy(wchar_t *__restrict, const wchar_t *__restrict, size_t);
2+
#include <string.h>
3+
#include <wchar.h>
84

95
void f1() {
106
wchar_t w1[] = L"codeql";

‎rule_packages/c/Strings1.json

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,10 @@
5858
"tags": [
5959
"correctness",
6060
"security"
61-
]
61+
],
62+
"implementation_scope": {
63+
"description": "Wide character types are not handled correctly on the `aarch64le` architecture. This can lead to false negative alerts."
64+
}
6265
}
6366
],
6467
"title": "Do not pass a non-null-terminated character sequence to a library function that expects a string"

‎rule_packages/c/Strings3.json

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,10 @@
3535
"tags": [
3636
"correctness",
3737
"security"
38-
]
38+
],
39+
"implementation_scope": {
40+
"description": "Wide character types are not handled correctly on the `aarch64le` architecture. This can lead to false negative alerts."
41+
}
3942
}
4043
],
4144
"title": "Do not confuse narrow and wide character strings and functions"

0 commit comments

Comments
 (0)