Enhance cpp/overflow-calculated - detect out-of-bounds write caused by passing the buffer size in bytes (using sizeof) instead of the number of elements to wcsftime, allowing the function to overrun the allocated buffer.
#19722
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Pointer case: sizeof(pointer) gives pointer size (e.g., 8 bytes), which is completely wrong
felickz
commented
Jun 11, 2025
| @@ -0,0 +1,4 @@ | |||
| --- | |||
| category: newQuery | |||
Contributor
Author
There was a problem hiding this comment.
This query did exist previously but did not have any precision so it was not included in any suite.
Also enhanced the query to find additional scenarios - what would be best category?
felickz
commented
Jun 11, 2025
| * @name Buffer overflow from insufficient space or incorrect size calculation | ||
| * @description A buffer allocated using 'malloc' may not have enough space for a string being copied into it, or wide character functions may receive incorrect size parameters causing buffer overrun. Make sure that buffers contain enough room for strings (including zero terminator) and that size parameters are correctly calculated. | ||
| * @kind problem | ||
| * @precision medium |
Contributor
Author
There was a problem hiding this comment.
This will add to security-extended suite. Review findings in DCA to ensure FP rate is low. FN's have not been evaluated by me - only added coverage for the above scenario only.
felickz
commented
Jun 12, 2025
| ql/cpp/ql/src/Critical/IncorrectCheckScanf.ql | ||
| ql/cpp/ql/src/Critical/MissingCheckScanf.ql | ||
| ql/cpp/ql/src/Critical/NewFreeMismatch.ql | ||
| ql/cpp/ql/src/Critical/OverflowCalculated.ql |
Contributor
Author
There was a problem hiding this comment.
Hand rolled this, security-and-quality, and not_included_in
mohannadmir
referenced
this pull request
Sep 25, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request improves the detection of buffer overflow issues in the
OverflowCalculated.qlquery.Improvements to buffer overflow detection:
Enhanced query description: The description of the query has been updated to include scenarios involving incorrect size calculations for wide character functions, improving clarity and scope. Additionally, the precision level was set to "medium" to better reflect the query's behavior. (
cpp/ql/src/Critical/OverflowCalculated.ql, cpp/ql/src/Critical/OverflowCalculated.qlL2-R5)New predicate for wide character size issues: Added the
wideCharSizeofProblempredicate to detect cases where thesizeofoperator is incorrectly used withwcsftime, leading to potential buffer overflows. The predicate checks for miscalculations in thecountparameter by ensuring that the size is expressed in terms ofwchar_telements rather than bytes. (cpp/ql/src/Critical/OverflowCalculated.ql, cpp/ql/src/Critical/OverflowCalculated.qlR44-R64)Updated query logic: Modified the
whereclause in the query to include the newwideCharSizeofProblempredicate, enabling the detection of both traditional space problems and wide character size issues. (cpp/ql/src/Critical/OverflowCalculated.ql, cpp/ql/src/Critical/OverflowCalculated.qlR44-R64)