C path matching issue
- 主要語言
- CodeQL
- 星號
- 10.1k
- 分支
- 2.1k
- 平均合併
- 2 天 15 小時
- 30 天內合併 PR
- 141
描述
C language code
```
#include
#include
#include
#include
char buf[32];
int main(int argc, char* argv[], char* envp[]){
if(argc<2){
printf("./fd [输入一个参数]\n");
return 0;
}
int fd = atoi( argv[1] ) - 0x1234;
int len = 0;
len = read(fd, buf, 32);
if(!strcmp("LETMEWIN\n", buf)){
printf("恭喜你!挑战成功!\n");
exit(0);
}
printf("程序结束\n");
return 0;
}
```
This is my rule.
```
/**
* @kind path-problem
* @problem.severity warning
* @id getenv-to-gethostbyname
*/
import cpp
import semmle.code.cpp.dataflow.new.DataFlow
import semmle.code.cpp.dataflow.ExternalFlow
module ReadConfig implements DataFlow::ConfigSig{
predicate isSource(DataFlow::Node source) {
exists(Parameter p, ArrayExpr ae |
p.getFunction().getName() = "main" and
ae.getArrayBase() = p.getAnAccess() and
source.asExpr() = ae
)
}
predicate isSink(DataFlow::Node sink) {
exists(FunctionCall fc |
fc.getTarget().getName() = "read" and
sink.asExpr() = fc.getArgument(0)
)
}
}
module ReadConfigFlow = DataFlow::Global;
import ReadConfigFlow::PathGraph
from ReadConfigFlow::PathNode source, ReadConfigFlow::PathNode sink
where ReadConfigFlow::flowPath(source, sink)
select sink.getNode(), source, sink, "read",
source, "input"
```
The source can match argv[1].
The sink can also match the file descriptor (fd) of the read function.
However, the rule as a whole fails to match the path.
Please help me.
貢獻指南
研究方向
Start with the supplied C example and the ReadConfig DataFlow configuration, comparing the argv[1] source with the read call's file-descriptor argument. Trace how the fd assignment and read argument are represented in the PathGraph, then determine why the individual matches do not produce a complete path. Done means documenting or reproducing the cause and identifying the expected matching behavior.
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- c
- 領域
- security
- Issue 類型
- 缺陷
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 活躍度
- 停滯
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100