Use-After-Query.ql does not work on this simple situation
- Ngôn ngữ chính
- CodeQL
- Star
- 10.1k
- Fork
- 2.1k
- Merge trung bình
- 2 ngày 15 giờ
- Pull request đã merge (30 ngày)
- 141
Mô tả
I use Use-After-Query.ql to detec a simple c code which exists UAF bug , but it doesn't works
- Use-After-Query.ql
```
/**
* @name Potential use after free
* @description An allocated memory block is used after it has been freed. Behavior in such cases is undefined and can cause memory corruption.
* @kind path-problem
* @precision high
* @id cpp/use-after-free
* @problem.severity warning
* @security-severity 9.3
* @tags reliability
* security
* external/cwe/cwe-416
*/
import cpp
import semmle.code.cpp.dataflow.new.DataFlow
import semmle.code.cpp.ir.IR
import semmle.code.cpp.security.flowafterfree.FlowAfterFree
import semmle.code.cpp.security.flowafterfree.UseAfterFree
import UseAfterFreeTrace::PathGraph
module UseAfterFreeParam implements FlowFromFreeParamSig {
predicate isSink = isUse/2;
predicate isExcluded = isExcludedMmFreePageFromMdl/2;
predicate sourceSinkIsRelated = defaultSourceSinkIsRelated/2;
}
import UseAfterFreeParam
module UseAfterFreeTrace = FlowFromFree;
from UseAfterFreeTrace::PathNode source, UseAfterFreeTrace::PathNode sink, DeallocationExpr dealloc
where
UseAfterFreeTrace::flowPath(source, sink) and
isFree(source.getNode(), _, _, dealloc)
select sink.getNode(), source, sink, "Memory may have been previously freed by $@.", dealloc,
dealloc.toString()
```
- my code
```
#include
#include
#include
void process_buffer(char *buffer) {
if (buffer != NULL) {
printf("Processing buffer: %s\n", buffer);
}
}
void free_buffer(char *buffer) {
if (buffer != NULL) {
free(buffer); // 释放内存
printf("Buffer freed.\n");
}
}
void use_after_free(char *buffer) {
// 释放后再次使用内存,存在UAF漏洞
process_buffer(buffer);
}
int main() {
char *buffer = (char *)malloc(100); // 分配100字节的内存
if (buffer == NULL) {
perror("Failed to allocate memory");
exit(EXIT_FAILURE);
}
strcpy(buffer, "This is a test string."); // 使用分配的内存
printf("Buffer before free: %s\n", buffer);
free_buffer(buffer); // 调用函数释放内存
use_after_free(buffer); // 释放后再次使用
return 0;
}
```
its result shows there has no bugs, I don't know why
Hướng dẫn đóng góp
Hướng nghiên cứu
Start with Use-After-Query.ql and the C reproducer in the issue, then run the query against that example to confirm the missing result. Trace the flow through the shown free_buffer, use_after_free, and process_buffer entry points; done means explaining or correcting why this path is not reported and adding a regression test if the repository has a suitable test location.
Do mô hình lập chỉ mục viết ra từ nội dung của issue.
Đánh giá
- Công nghệ
- c
- Lĩnh vực
- security
- Loại issue
- Lỗi
- Độ khó
- 4/5
- Thời gian dự kiến
- 3-5 ngày
- Mức độ hoạt động
- Đình trệ
- Độ rõ ràng
- Khá rõ ràng
- Mức phù hợp với người mới
- 35/100