github / github/codeql

False Negative:ArrayIndexOutOfBounds.ql

Aperta
#21,528 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
CodeQL
Stelle
10.1k
Fork
2.1k
Merge medio
2g 15h
PR unite (30g)
141

Descrizione

Version
codeql 2.23.9

When I detect the code like this using Likely Bugs/Collections/ArrayIndexOutOfBounds.ql, the problem is reported normally:
```java
package scensct.core.pos;
public class PosCase1 {
public static void main(String[] args) {
int[] arr = new int[5];
int index = 10; // Unbounded index, no constraint check before access
int value = arr[index]; // Direct access with potentially out-of-bounds index // [REPORTED LINE]
}
}
```

However, when I use a mediator variable or call a mediator function, ArrayIndexOutOfBounds.ql fails to detect the problem:
```java
package scensct.var.pos;

public class PosCase1_Var4 {
public static void main(String[] args) {
int[] arr = createArray();
int index = getIndex();
int value = arr[index]; // Access with index from method
}

private static int[] createArray() {
return new int[5];
}

private static int getIndex() {
return 10;
}
}

```
```java
package scensct.var.pos;

public class PosCase2_Var4 {
public static void main(String[] args) {
int[] arr = new int[5];
int K = 5;
// Introduce an alias reference
int[] alias = arr;
int index = K;
int value = alias[index];
}
}

```

```java
package scensct.var.pos;

public class PosCase2_Var5 {
private static int getIndex(int k) {
return k;
}

public static void main(String[] args) {
int[] arr = new int[5];
int K = 5;
// Move index computation to a helper method
int index = getIndex(K);
int value = arr[index];
}
}
```

```java
package scensct.core.pos;

public class PosCase3 {
public static void main(String[] args) {
int[] arr = new int[5];
int K = -1; // Negative bound
int index = K + 0; // Index bounded below by negative K
int value = arr[index]; // Access with potentially negative index
}
}
```

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Start with Likely Bugs/Collections/ArrayIndexOutOfBounds.ql and compare how it handles direct array access with accesses using helper methods, aliases, and computed indices. Reproduce the Java examples from the issue, then verify that the query reports each out-of-bounds access, including negative indices.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
java
Ambito
security
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Tranquilla
Chiarezza
Abbastanza chiara
Idoneità per principianti
45/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.