github / github/codeql

Use-After-Query.ql does not work on this simple situation

Abierto
#16,542 2 comentarios 0 reacciones 0 asignados Ver en GitHub
C++ question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

I use Use-After-Query.ql to detec a simple c code which exists UAF bug , but it doesn't works
- Use-After-Query.ql

```
/**
* @name Potential use after free
* @description An allocated memory block is used after it has been freed. Behavior in such cases is undefined and can cause memory corruption.
* @kind path-problem
* @precision high
* @id cpp/use-after-free
* @problem.severity warning
* @security-severity 9.3
* @tags reliability
* security
* external/cwe/cwe-416
*/

import cpp
import semmle.code.cpp.dataflow.new.DataFlow
import semmle.code.cpp.ir.IR
import semmle.code.cpp.security.flowafterfree.FlowAfterFree
import semmle.code.cpp.security.flowafterfree.UseAfterFree
import UseAfterFreeTrace::PathGraph

module UseAfterFreeParam implements FlowFromFreeParamSig {
predicate isSink = isUse/2;

predicate isExcluded = isExcludedMmFreePageFromMdl/2;

predicate sourceSinkIsRelated = defaultSourceSinkIsRelated/2;
}

import UseAfterFreeParam

module UseAfterFreeTrace = FlowFromFree;

from UseAfterFreeTrace::PathNode source, UseAfterFreeTrace::PathNode sink, DeallocationExpr dealloc
where
UseAfterFreeTrace::flowPath(source, sink) and
isFree(source.getNode(), _, _, dealloc)
select sink.getNode(), source, sink, "Memory may have been previously freed by $@.", dealloc,
dealloc.toString()

```

- my code
```
#include
#include
#include

void process_buffer(char *buffer) {
if (buffer != NULL) {
printf("Processing buffer: %s\n", buffer);
}
}

void free_buffer(char *buffer) {
if (buffer != NULL) {
free(buffer); // 释放内存
printf("Buffer freed.\n");
}
}

void use_after_free(char *buffer) {
// 释放后再次使用内存,存在UAF漏洞
process_buffer(buffer);
}

int main() {
char *buffer = (char *)malloc(100); // 分配100字节的内存
if (buffer == NULL) {
perror("Failed to allocate memory");
exit(EXIT_FAILURE);
}

strcpy(buffer, "This is a test string."); // 使用分配的内存
printf("Buffer before free: %s\n", buffer);

free_buffer(buffer); // 调用函数释放内存

use_after_free(buffer); // 释放后再次使用

return 0;
}

```
its result shows there has no bugs, I don't know why

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.