how to filter out this situation?
- Dominant language
- CodeQL
- Stars
- 10.1k
- Forks
- 2.1k
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 141
Description
Hi, I have been learning to use CodeQL recently. I was trying to find all expressions that reach the `len` parameter of `memcpy`, and in the results, there is a case like the following.
```c
attr->val.octets = _malloc(attr->length);
if (!attr->val.octets)
goto out_err_mem;
memcpy(attr->val.octets, orig_avp_val, attr->length);
```
In this part, the `len` parameter of `memcpy` is exactly the same as the parameter of `_malloc`, which I consider to be safe. Therefore, I would like to exclude this situation. However, first, I want to identify this pattern, so I have written the following code.
```ql
import cpp
import semmle.code.cpp.dataflow.new.DataFlow
import semmle.code.cpp.dataflow.new.TaintTracking
// class MallocSize extends Expr {
// MallocSize() {
// exists(FunctionCall fc |
// fc.getTarget().hasName("malloc") and
// this = fc.getArgument(0)
// )
// }
// }
module RecvToMemcpyConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
exists(Expr e | source.asExpr() = e
and not e.isConstant()
)
}
predicate isSink(DataFlow::Node sink) {
exists(FunctionCall fc, FunctionCall mc |
fc.getTarget().hasName("memcpy") and mc.getTarget().hasName("malloc")
and sink.asExpr() = fc.getArgument(2)
and fc.getArgument(2) = mc.getArgument(0)
)
and not sink.asExpr().isConstant()
}
}
module RecvToMemcpyFlow = TaintTracking::Global;
from RecvToMemcpyFlow::PathNode source, RecvToMemcpyFlow::PathNode sink
where RecvToMemcpyFlow::flowPath(source, sink)
select
source,
sink,
sink.getNode().getFunction().getFile(),
source.getNode().getFunction().getFile()
```
Although I think this code may not handle the following situation, I believe it should be able to handle the case where the `size` parameter of `malloc` and the `len` parameter of `memcpy` are exactly the same, meaning when the expressions are an exact match.
```c
b = _malloc(sizeof(*b) + size);
b->size = size;
memcpy(b->buf, buf, size);
```
But the result returns 0 results.
I also tried other approaches, but none of them met my expectations. How should I correctly handle this situation?
Contributor guide
Assessment
This issue has not been assessed yet.