Skip to content

Commit 1f2598e

Browse files
GrosQuilduGrosQuildu
committed
fix tests
1 parent cd0a204 commit 1f2598e

4 files changed

Lines changed: 25 additions & 23 deletions

File tree

‎cpp/src/security/InconsistentReturnValueHandling/InconsistentReturnValueHandling.ql‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
/**
22
* @name Inconsistent handling of return values from a specific function
33
* @description If a function's return value is used in `if` statements,
4-
* and in a few statements the value is compared somehow differently than it is usually,
5-
* then this rare comparisons may indicate bugs.
4+
* and in a few statements the value is compared differently than it is usually,
5+
* then this rare comparisons are bugs indicators.
66
* The query categorizes uses of return values into a few categories
77
* (cmp with int, bool, nullptr, sizeof, another function, ...)
88
* @kind problem
@@ -238,9 +238,10 @@ from Function f, int retValsTotalAmount,
238238
TCmpClass buggyCategory, CmpClass buggyCategoryClass, Call buggyFc,
239239
IfStmt ifs
240240
where
241-
not buggyFc.getLocation().getFile().toString().toLowerCase().regexpMatch(".*test.*")
241+
// not buggyFc.getLocation().getFile().toString().toLowerCase().regexpMatch(".*test.*") and
242+
242243
// we are interested only in defined (e.g., not libc) and used functions
243-
and exists(Call fc | fc.getTarget() = f)
244+
exists(Call fc | fc.getTarget() = f)
244245
and f.hasDefinition()
245246

246247
// the function's retVal must be used in some IF statements
@@ -254,7 +255,7 @@ where
254255
// if threshold for "most common" use case is ~75%, then remaining 25% function calls are handled somehow incorrectly
255256
and ((float)(categoryMax * 100) / retValsTotalAmount) >= 74
256257

257-
// // and finally we are looking for calls that use retVal in an uncommon way
258+
// finally we are looking for calls that use retVal in an uncommon way
258259
and categorize(f, buggyFc, buggyCategory, ifs)
259260
and buggyCategory != mostCommonCategory
260261
and buggyCategoryClass = buggyCategory

‎cpp/test/include/libc/string_stubs.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@ extern "C" {
1111
#define NULL 0
1212
#endif
1313

14+
#ifndef __cplusplus
1415
typedef int wchar_t;
16+
#endif
1517
extern void *memcpy(void *dst, const void *src, unsigned long n);
1618
extern char* strcpy_s(char* dst, int max_amount, char* src);
1719
extern int _mbsncat(char* dst, char* src, int count);

‎cpp/test/query-tests/security/InconsistentReturnValueHandling/InconsistentReturnValueHandling.cpp‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,8 @@ int target_func_1(int a)
3232
return a + 1;
3333
}
3434

35-
void test_1_1() {
36-
// BAD: comparing with sizeof instead of hard-coded int
37-
if (target_func_1(2) != sizeof(something)) {
38-
puts("something");
39-
}
40-
}
41-
4235
void test_1_2() {
36+
// the baseline for target_func_1
4337
if (target_func_1(2) != 1) {
4438
puts("something2");
4539
}
@@ -52,7 +46,12 @@ void test_1_2() {
5246
}
5347
}
5448

55-
49+
void test_1_1() {
50+
// BAD: comparing with sizeof instead of hard-coded int
51+
if (target_func_1(2) != sizeof(something)) {
52+
puts("something");
53+
}
54+
}
5655

5756
// BAD 2
5857
int target_func_2(int a)

‎cpp/test/query-tests/security/InconsistentReturnValueHandling/InconsistentReturnValueHandling.expected‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
| InconsistentReturnValueHandling.cpp:37:9:37:21 | call to target_func_1 | Function $@ return value is usually compared with numeric literal (3 of 4 times), but this call compares with sizeof(something) $@ | InconsistentReturnValueHandling.cpp:30:5:30:17 | target_func_1 | target_func_1 | InconsistentReturnValueHandling.cpp:37:5:39:5 | if (...) ... | here |
2-
| InconsistentReturnValueHandling.cpp:78:9:78:21 | call to target_func_2 | Function $@ return value is usually compared with sizeof(something) (3 of 4 times), but this call compares with numeric literal $@ | InconsistentReturnValueHandling.cpp:58:5:58:17 | target_func_2 | target_func_2 | InconsistentReturnValueHandling.cpp:80:5:82:5 | if (...) ... | here |
3-
| InconsistentReturnValueHandling.cpp:121:9:121:21 | call to target_func_3 | Function $@ return value is usually compared with sizeof(something) (6 of 8 times), but this call compares with sizeof(athing) $@ | InconsistentReturnValueHandling.cpp:86:5:86:17 | target_func_3 | target_func_3 | InconsistentReturnValueHandling.cpp:123:5:125:5 | if (...) ... | here |
4-
| InconsistentReturnValueHandling.cpp:127:9:127:21 | call to target_func_3 | Function $@ return value is usually compared with sizeof(something) (6 of 8 times), but this call compares with sizeof(athing) $@ | InconsistentReturnValueHandling.cpp:86:5:86:17 | target_func_3 | target_func_3 | InconsistentReturnValueHandling.cpp:129:5:131:5 | if (...) ... | here |
5-
| InconsistentReturnValueHandling.cpp:194:13:194:25 | call to target_func_4 | Function $@ return value is usually compared with numeric literal (8 of 9 times), but this call compares with bool $@ | InconsistentReturnValueHandling.cpp:201:5:201:28 | target_func_4 | target_func_4 | InconsistentReturnValueHandling.cpp:196:5:198:5 | if (...) ... | here |
6-
| InconsistentReturnValueHandling.cpp:226:9:226:21 | call to target_func_5 | Function $@ return value is usually compared with null (3 of 4 times), but this call compares with pointer $@ | InconsistentReturnValueHandling.cpp:206:6:206:18 | target_func_5 | target_func_5 | InconsistentReturnValueHandling.cpp:229:5:231:5 | if (...) ... | here |
7-
| InconsistentReturnValueHandling.cpp:255:9:255:21 | call to target_func_6 | Function $@ return value is usually compared with some function's return value (3 of 4 times), but this call compares with sizeof(something) $@ | InconsistentReturnValueHandling.cpp:235:6:235:18 | target_func_6 | target_func_6 | InconsistentReturnValueHandling.cpp:257:5:259:5 | if (...) ... | here |
8-
| InconsistentReturnValueHandling.cpp:286:9:286:21 | call to target_func_7 | Function $@ return value is usually compared within call to some function (3 of 4 times), but this call compares with some function's return value $@ | InconsistentReturnValueHandling.cpp:263:6:263:18 | target_func_7 | target_func_7 | InconsistentReturnValueHandling.cpp:288:5:290:5 | if (...) ... | here |
9-
| InconsistentReturnValueHandling.cpp:317:9:317:21 | call to target_func_8 | Function $@ return value is usually compared with arithmetic expression (3 of 4 times), but this call compares with numeric literal $@ | InconsistentReturnValueHandling.cpp:294:6:294:18 | target_func_8 | target_func_8 | InconsistentReturnValueHandling.cpp:319:5:321:5 | if (...) ... | here |
10-
| InconsistentReturnValueHandling.cpp:347:20:347:32 | call to target_func_9 | Function $@ return value is usually compared with null (3 of 4 times), but this call compares with numeric literal $@ | InconsistentReturnValueHandling.cpp:325:6:325:18 | target_func_9 | target_func_9 | InconsistentReturnValueHandling.cpp:347:5:349:5 | if (...) ... | here |
1+
| InconsistentReturnValueHandling.cpp:51:9:51:21 | call to target_func_1 | Function $@ return value is usually compared with numeric literal (3 of 4 times), but this call compares with sizeof(something) $@ | InconsistentReturnValueHandling.cpp:30:5:30:17 | target_func_1 | target_func_1 | InconsistentReturnValueHandling.cpp:51:5:53:5 | if (...) ... | here |
2+
| InconsistentReturnValueHandling.cpp:77:9:77:21 | call to target_func_2 | Function $@ return value is usually compared with sizeof(something) (3 of 4 times), but this call compares with numeric literal $@ | InconsistentReturnValueHandling.cpp:57:5:57:17 | target_func_2 | target_func_2 | InconsistentReturnValueHandling.cpp:79:5:81:5 | if (...) ... | here |
3+
| InconsistentReturnValueHandling.cpp:120:9:120:21 | call to target_func_3 | Function $@ return value is usually compared with sizeof(something) (6 of 8 times), but this call compares with sizeof(athing) $@ | InconsistentReturnValueHandling.cpp:85:5:85:17 | target_func_3 | target_func_3 | InconsistentReturnValueHandling.cpp:122:5:124:5 | if (...) ... | here |
4+
| InconsistentReturnValueHandling.cpp:126:9:126:21 | call to target_func_3 | Function $@ return value is usually compared with sizeof(something) (6 of 8 times), but this call compares with sizeof(athing) $@ | InconsistentReturnValueHandling.cpp:85:5:85:17 | target_func_3 | target_func_3 | InconsistentReturnValueHandling.cpp:128:5:130:5 | if (...) ... | here |
5+
| InconsistentReturnValueHandling.cpp:193:13:193:25 | call to target_func_4 | Function $@ return value is usually compared with numeric literal (8 of 9 times), but this call compares with bool $@ | InconsistentReturnValueHandling.cpp:200:5:200:28 | target_func_4 | target_func_4 | InconsistentReturnValueHandling.cpp:195:5:197:5 | if (...) ... | here |
6+
| InconsistentReturnValueHandling.cpp:225:9:225:21 | call to target_func_5 | Function $@ return value is usually compared with null (3 of 4 times), but this call compares with pointer $@ | InconsistentReturnValueHandling.cpp:205:6:205:18 | target_func_5 | target_func_5 | InconsistentReturnValueHandling.cpp:228:5:230:5 | if (...) ... | here |
7+
| InconsistentReturnValueHandling.cpp:254:9:254:21 | call to target_func_6 | Function $@ return value is usually compared with some function's return value (3 of 4 times), but this call compares with sizeof(something) $@ | InconsistentReturnValueHandling.cpp:234:6:234:18 | target_func_6 | target_func_6 | InconsistentReturnValueHandling.cpp:256:5:258:5 | if (...) ... | here |
8+
| InconsistentReturnValueHandling.cpp:285:9:285:21 | call to target_func_7 | Function $@ return value is usually compared within a function (3 of 4 times), but this call compares with some function's return value $@ | InconsistentReturnValueHandling.cpp:262:6:262:18 | target_func_7 | target_func_7 | InconsistentReturnValueHandling.cpp:287:5:289:5 | if (...) ... | here |
9+
| InconsistentReturnValueHandling.cpp:316:9:316:21 | call to target_func_8 | Function $@ return value is usually compared with arithmetic expression (3 of 4 times), but this call compares with numeric literal $@ | InconsistentReturnValueHandling.cpp:293:6:293:18 | target_func_8 | target_func_8 | InconsistentReturnValueHandling.cpp:318:5:320:5 | if (...) ... | here |
10+
| InconsistentReturnValueHandling.cpp:346:20:346:32 | call to target_func_9 | Function $@ return value is usually compared with null (3 of 4 times), but this call compares with numeric literal $@ | InconsistentReturnValueHandling.cpp:324:6:324:18 | target_func_9 | target_func_9 | InconsistentReturnValueHandling.cpp:346:5:348:5 | if (...) ... | here |

0 commit comments

Comments
 (0)