Skip to content

Commit 76ef779

Browse files
geoffw0d10c
authored andcommitted
C++: Add test and placeholder query.
1 parent 94c43c0 commit 76ef779

File tree

4 files changed

+210
-0
lines changed

4 files changed

+210
-0
lines changed
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
/**
2+
* @name TODO
3+
* @description TODO
4+
* @kind problem
5+
* @problem.severity TODO
6+
* @security-severity TODO
7+
* @precision TODO
8+
* @id cpp/missing-check-scanf
9+
* @tags TODO
10+
*/
11+
12+
import cpp
13+
14+
select "TODO"

cpp/ql/test/query-tests/Critical/MissingCheckScanf/MissingCheckScanf.expected

Whitespace-only changes.
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Critical/MissingCheckScanf.ql
Lines changed: 195 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
typedef struct {} FILE;
2+
3+
int scanf(const char *format, ...);
4+
int fscanf(FILE *stream, const char *format, ...);
5+
int sscanf(const char *s, const char *format, ...);
6+
7+
void use(int i);
8+
9+
void set_by_ref(int &i);
10+
void set_by_ptr(int *i);
11+
bool maybe();
12+
13+
FILE *get_a_stream();
14+
const char *get_a_string();
15+
16+
int main()
17+
{
18+
// --- simple cases ---
19+
20+
{
21+
int i;
22+
23+
scanf("%d", &i); // BAD: may not have written `i`
24+
use(i);
25+
}
26+
27+
{
28+
int i;
29+
30+
if (scanf("%d", &i) == 1) // GOOD: checks return value
31+
{
32+
use(i);
33+
}
34+
}
35+
36+
{
37+
int i = 0;
38+
39+
scanf("%d", &i); // GOOD: we assume the initialization of `i` is a reasonable default
40+
use(i);
41+
}
42+
43+
// --- different scanf functions ---
44+
45+
{
46+
int i;
47+
48+
fscanf(get_a_stream(), "%d", &i); // BAD: may not have written `i`
49+
use(i);
50+
}
51+
52+
{
53+
int i;
54+
55+
sscanf(get_a_string(), "%d", &i); // BAD: may not have written `i`
56+
use(i);
57+
}
58+
59+
// --- different ways of checking ---
60+
61+
{
62+
int i;
63+
64+
if (scanf("%d", &i) >= 1) // GOOD
65+
{
66+
use(i);
67+
}
68+
}
69+
70+
{
71+
int i;
72+
73+
if (scanf("%d", &i) == 1) // GOOD
74+
{
75+
use(i);
76+
}
77+
}
78+
79+
{
80+
int i;
81+
82+
if (scanf("%d", &i) != 0) // GOOD (just barely)
83+
{
84+
use(i);
85+
}
86+
}
87+
88+
{
89+
int i;
90+
91+
if (scanf("%d", &i) == 0) // BAD: checks return value incorrectly
92+
{
93+
use(i);
94+
}
95+
}
96+
97+
{
98+
bool b;
99+
int i;
100+
101+
b = scanf("%d", &i); // GOOD
102+
103+
if (b >= 1)
104+
{
105+
use(i);
106+
}
107+
}
108+
109+
{
110+
int i, j;
111+
112+
if (scanf("%d %d", &i) >= 2) // GOOD
113+
{
114+
use(i);
115+
use(j);
116+
}
117+
}
118+
119+
{
120+
int i, j;
121+
122+
if (scanf("%d %d", &i) >= 1) // BAD: checks return value incorrectly
123+
{
124+
use(i);
125+
use(j);
126+
}
127+
}
128+
129+
// --- different initialization ---
130+
131+
{
132+
int i;
133+
i = 0;
134+
135+
scanf("%d", &i); // GOOD
136+
use(i);
137+
}
138+
139+
{
140+
int i;
141+
142+
set_by_ref(i);
143+
scanf("%d", &i); // GOOD: we have to assume `i` was initialized
144+
use(i);
145+
}
146+
147+
{
148+
int i;
149+
150+
set_by_ptr(&i);
151+
scanf("%d", &i); // GOOD: we have to assume `i` was initialized
152+
use(i);
153+
}
154+
155+
{
156+
int i;
157+
158+
if (maybe())
159+
{
160+
i = 0;
161+
}
162+
163+
scanf("%d", &i); // BAD: `i` may not have been initialized
164+
use(i);
165+
}
166+
167+
// --- weird formatting strings ---
168+
169+
{
170+
int i;
171+
172+
if (scanf("%n %d", &i) >= 1) // GOOD (`%n` does not consume input)
173+
{
174+
use(i);
175+
}
176+
}
177+
178+
{
179+
int i;
180+
181+
if (scanf("%% %d", &i) >= 1) // GOOD (`%%` does not consume input)
182+
{
183+
use(i);
184+
}
185+
}
186+
187+
{
188+
int i;
189+
190+
if (scanf("%*d %d", &i) >= 1) // GOOD (`%*d` does not consume input)
191+
{
192+
use(i);
193+
}
194+
}
195+
}

0 commit comments

Comments
 (0)