@@ -35,8 +35,8 @@ predicate isMinValue(MacroInvocationExpr mie) {
35
35
36
36
class SecurityOptionsArith extends SecurityOptions {
37
37
override predicate isUserInput ( Expr expr , string cause ) {
38
- ( isMaxValue ( expr ) and cause = "overflow " ) or
39
- ( isMinValue ( expr ) and cause = "underflow " )
38
+ ( isMaxValue ( expr ) and cause = "max value " ) or
39
+ ( isMinValue ( expr ) and cause = "min value " )
40
40
}
41
41
}
42
42
@@ -45,13 +45,24 @@ predicate taintedVarAccess(Expr origin, VariableAccess va, string cause) {
45
45
tainted ( origin , va )
46
46
}
47
47
48
- from Expr origin , Operation op , VariableAccess va , string effect
49
- where taintedVarAccess ( origin , va , effect )
48
+ predicate causeEffectCorrespond ( string cause , string effect ) {
49
+ (
50
+ cause = "max value" and
51
+ effect = "overflow"
52
+ ) or (
53
+ cause = "min value" and
54
+ effect = "underflow"
55
+ )
56
+ }
57
+
58
+ from Expr origin , Operation op , VariableAccess va , string cause , string effect
59
+ where taintedVarAccess ( origin , va , cause )
50
60
and op .getAnOperand ( ) = va
51
61
and
52
62
(
53
63
( missingGuardAgainstUnderflow ( op , va ) and effect = "underflow" ) or
54
64
( missingGuardAgainstOverflow ( op , va ) and effect = "overflow" )
55
- )
65
+ ) and
66
+ causeEffectCorrespond ( cause , effect )
56
67
select va , "$@ flows to here and is used in arithmetic, potentially causing an " + effect + "." ,
57
68
origin , "Extreme value"
0 commit comments