Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 966b746

Browse filesBrowse files
jketemajketema
authored
Merge pull request github#19397 from jketema/use-after-free
C++: Add use-after-free FP tests
2 parents 50f7ee1 + 0bb0b5c commit 966b746
Copy full SHA for 966b746

File tree

Expand file treeCollapse file tree

2 files changed

+50
-1
lines changed
Filter options
Expand file treeCollapse file tree

2 files changed

+50
-1
lines changed

‎cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/UseAfterFree.expected

Copy file name to clipboardExpand all lines: cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/UseAfterFree.expected
+24Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,16 @@ edges
1111
| test.cpp:203:7:203:10 | pointer to free output argument | test.cpp:209:6:209:9 | data | provenance | |
1212
| test.cpp:207:8:207:11 | pointer to free output argument | test.cpp:209:6:209:9 | data | provenance | |
1313
| test.cpp:216:9:216:9 | pointer to operator delete output argument | test.cpp:217:6:217:6 | x | provenance | |
14+
| test.cpp:243:7:243:7 | *s [post update] [i1, data] | test.cpp:248:6:248:6 | *s [i1, data] | provenance | |
15+
| test.cpp:243:7:243:16 | pointer to free output argument | test.cpp:243:10:243:11 | *i1 [post update] [data] | provenance | |
16+
| test.cpp:243:10:243:11 | *i1 [post update] [data] | test.cpp:243:7:243:7 | *s [post update] [i1, data] | provenance | |
17+
| test.cpp:248:6:248:6 | *s [i1, data] | test.cpp:248:9:248:10 | *i1 [data] | provenance | |
18+
| test.cpp:248:9:248:10 | *i1 [data] | test.cpp:248:12:248:15 | data | provenance | |
19+
| test.cpp:250:7:250:7 | *s [post update] [*i2, data] | test.cpp:255:6:255:6 | *s [*i2, data] | provenance | |
20+
| test.cpp:250:7:250:17 | pointer to free output argument | test.cpp:250:10:250:11 | *i2 [post update] [data] | provenance | |
21+
| test.cpp:250:10:250:11 | *i2 [post update] [data] | test.cpp:250:7:250:7 | *s [post update] [*i2, data] | provenance | |
22+
| test.cpp:255:6:255:6 | *s [*i2, data] | test.cpp:255:9:255:10 | *i2 [data] | provenance | |
23+
| test.cpp:255:9:255:10 | *i2 [data] | test.cpp:255:13:255:16 | data | provenance | |
1424
nodes
1525
| test.cpp:39:7:39:10 | pointer to free output argument | semmle.label | pointer to free output argument |
1626
| test.cpp:41:6:41:9 | data | semmle.label | data |
@@ -35,6 +45,18 @@ nodes
3545
| test.cpp:209:6:209:9 | data | semmle.label | data |
3646
| test.cpp:216:9:216:9 | pointer to operator delete output argument | semmle.label | pointer to operator delete output argument |
3747
| test.cpp:217:6:217:6 | x | semmle.label | x |
48+
| test.cpp:243:7:243:7 | *s [post update] [i1, data] | semmle.label | *s [post update] [i1, data] |
49+
| test.cpp:243:7:243:16 | pointer to free output argument | semmle.label | pointer to free output argument |
50+
| test.cpp:243:10:243:11 | *i1 [post update] [data] | semmle.label | *i1 [post update] [data] |
51+
| test.cpp:248:6:248:6 | *s [i1, data] | semmle.label | *s [i1, data] |
52+
| test.cpp:248:9:248:10 | *i1 [data] | semmle.label | *i1 [data] |
53+
| test.cpp:248:12:248:15 | data | semmle.label | data |
54+
| test.cpp:250:7:250:7 | *s [post update] [*i2, data] | semmle.label | *s [post update] [*i2, data] |
55+
| test.cpp:250:7:250:17 | pointer to free output argument | semmle.label | pointer to free output argument |
56+
| test.cpp:250:10:250:11 | *i2 [post update] [data] | semmle.label | *i2 [post update] [data] |
57+
| test.cpp:255:6:255:6 | *s [*i2, data] | semmle.label | *s [*i2, data] |
58+
| test.cpp:255:9:255:10 | *i2 [data] | semmle.label | *i2 [data] |
59+
| test.cpp:255:13:255:16 | data | semmle.label | data |
3860
subpaths
3961
#select
4062
| test.cpp:41:6:41:9 | data | test.cpp:39:7:39:10 | pointer to free output argument | test.cpp:41:6:41:9 | data | Memory may have been previously freed by $@. | test.cpp:39:2:39:5 | call to free | call to free |
@@ -49,3 +71,5 @@ subpaths
4971
| test.cpp:209:6:209:9 | data | test.cpp:203:7:203:10 | pointer to free output argument | test.cpp:209:6:209:9 | data | Memory may have been previously freed by $@. | test.cpp:203:2:203:5 | call to free | call to free |
5072
| test.cpp:209:6:209:9 | data | test.cpp:207:8:207:11 | pointer to free output argument | test.cpp:209:6:209:9 | data | Memory may have been previously freed by $@. | test.cpp:207:3:207:6 | call to free | call to free |
5173
| test.cpp:217:6:217:6 | x | test.cpp:216:9:216:9 | pointer to operator delete output argument | test.cpp:217:6:217:6 | x | Memory may have been previously freed by $@. | test.cpp:216:2:216:9 | delete | delete |
74+
| test.cpp:248:12:248:15 | data | test.cpp:243:7:243:16 | pointer to free output argument | test.cpp:248:12:248:15 | data | Memory may have been previously freed by $@. | test.cpp:243:2:243:5 | call to free | call to free |
75+
| test.cpp:255:13:255:16 | data | test.cpp:250:7:250:17 | pointer to free output argument | test.cpp:255:13:255:16 | data | Memory may have been previously freed by $@. | test.cpp:250:2:250:5 | call to free | call to free |

‎cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp

Copy file name to clipboardExpand all lines: cpp/ql/test/query-tests/Security/CWE/CWE-416/semmle/tests/UseAfterFree/test.cpp
+26-1Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ void noReturnWrapper() { noReturn(); }
134134

135135
void test9()
136136
{
137-
char *data, *data2;
137+
char *data;
138138
free(data);
139139
noReturnWrapper();
140140
use_if_nonzero(data); // GOOD
@@ -229,3 +229,28 @@ void regression_test_for_static_var_handling()
229229
data = (char *)malloc(100*sizeof(char));
230230
use(data); // GOOD
231231
}
232+
233+
struct myInnerStruct {
234+
char *data;
235+
};
236+
237+
struct myStruct {
238+
myInnerStruct i1;
239+
myInnerStruct *i2;
240+
};
241+
242+
void malloc_after_free(myStruct *s) {
243+
free(s->i1.data);
244+
s->i1.data = (char *)malloc(100*sizeof(char));
245+
if (s->i1.data == 0) {
246+
return;
247+
}
248+
use(s->i1.data); // GOOD [FALSE POSITIVE]
249+
250+
free(s->i2->data);
251+
s->i2->data = (char *)malloc(100*sizeof(char));
252+
if (s->i2->data == 0) {
253+
return;
254+
}
255+
use(s->i2->data); // GOOD [FALSE POSITIVE]
256+
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.