Skip to content

Commit 5d37c1a

Browse files
committed
CPP: De-conflate cause and effect strings.
1 parent 2deb500 commit 5d37c1a

File tree

1 file changed

+16
-5
lines changed

1 file changed

+16
-5
lines changed

cpp/ql/src/Security/CWE/CWE-190/ArithmeticWithExtremeValues.ql

+16-5
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ predicate isMinValue(MacroInvocationExpr mie) {
3535

3636
class SecurityOptionsArith extends SecurityOptions {
3737
override predicate isUserInput(Expr expr, string cause) {
38-
(isMaxValue(expr) and cause = "overflow") or
39-
(isMinValue(expr) and cause = "underflow")
38+
(isMaxValue(expr) and cause = "max value") or
39+
(isMinValue(expr) and cause = "min value")
4040
}
4141
}
4242

@@ -45,13 +45,24 @@ predicate taintedVarAccess(Expr origin, VariableAccess va, string cause) {
4545
tainted(origin, va)
4646
}
4747

48-
from Expr origin, Operation op, VariableAccess va, string effect
49-
where taintedVarAccess(origin, va, effect)
48+
predicate causeEffectCorrespond(string cause, string effect) {
49+
(
50+
cause = "max value" and
51+
effect = "overflow"
52+
) or (
53+
cause = "min value" and
54+
effect = "underflow"
55+
)
56+
}
57+
58+
from Expr origin, Operation op, VariableAccess va, string cause, string effect
59+
where taintedVarAccess(origin, va, cause)
5060
and op.getAnOperand() = va
5161
and
5262
(
5363
(missingGuardAgainstUnderflow(op, va) and effect = "underflow") or
5464
(missingGuardAgainstOverflow(op, va) and effect = "overflow")
55-
)
65+
) and
66+
causeEffectCorrespond(cause, effect)
5667
select va, "$@ flows to here and is used in arithmetic, potentially causing an " + effect + ".",
5768
origin, "Extreme value"

0 commit comments

Comments
 (0)