Skip to content

Commit c048401

Browse files
jketemajketema
committed
C++: Clean up Brotli test
1 parent 0f98e29 commit c048401

File tree

2 files changed

+29
-38
lines changed

2 files changed

+29
-38
lines changed

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/DecompressionBombs.expected

+13-11
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
edges
2-
| brotliTest.cpp:26:41:26:44 | **argv | brotliTest.cpp:26:41:26:44 | **argv | provenance | |
3-
| brotliTest.cpp:26:41:26:44 | **argv | brotliTest.cpp:28:42:28:60 | *access to array | provenance | |
4-
| brotliTest.cpp:26:41:26:44 | **argv | brotliTest.cpp:34:35:34:40 | *input2 | provenance | TaintFunction |
2+
| brotliTest.cpp:15:41:15:44 | **argv | brotliTest.cpp:15:41:15:44 | **argv | provenance | |
3+
| brotliTest.cpp:15:41:15:44 | **argv | brotliTest.cpp:18:35:18:53 | *access to array | provenance | |
4+
| brotliTest.cpp:15:41:15:44 | **argv | brotliTest.cpp:21:30:21:52 | *access to array | provenance | |
5+
| brotliTest.cpp:21:30:21:52 | *access to array | brotliTest.cpp:24:51:24:58 | **& ... | provenance | |
56
| libarchiveTests.cpp:16:31:16:32 | *ar | libarchiveTests.cpp:16:31:16:32 | *ar | provenance | |
67
| libarchiveTests.cpp:16:31:16:32 | *ar | libarchiveTests.cpp:22:41:22:42 | *ar | provenance | |
78
| libarchiveTests.cpp:30:45:30:48 | **argv | libarchiveTests.cpp:30:45:30:48 | **argv | provenance | |
@@ -15,7 +16,7 @@ edges
1516
| main.cpp:7:33:7:36 | **argv | main.cpp:9:27:9:30 | **argv | provenance | |
1617
| main.cpp:7:33:7:36 | **argv | main.cpp:10:24:10:27 | **argv | provenance | |
1718
| main.cpp:7:33:7:36 | **argv | main.cpp:11:21:11:24 | **argv | provenance | |
18-
| main.cpp:8:23:8:26 | **argv | brotliTest.cpp:26:41:26:44 | **argv | provenance | |
19+
| main.cpp:8:23:8:26 | **argv | brotliTest.cpp:15:41:15:44 | **argv | provenance | |
1920
| main.cpp:8:23:8:26 | **argv | main.cpp:8:23:8:26 | brotli_test output argument | provenance | |
2021
| main.cpp:8:23:8:26 | brotli_test output argument | main.cpp:9:27:9:30 | **argv | provenance | |
2122
| main.cpp:8:23:8:26 | brotli_test output argument | main.cpp:10:24:10:27 | **argv | provenance | |
@@ -82,10 +83,11 @@ edges
8283
| zlibTest.cpp:84:18:84:24 | UnsafeGzread output argument | zlibTest.cpp:85:19:85:25 | *access to array | provenance | |
8384
| zlibTest.cpp:85:19:85:25 | *access to array | zlibTest.cpp:71:26:71:30 | *input | provenance | |
8485
nodes
85-
| brotliTest.cpp:26:41:26:44 | **argv | semmle.label | **argv |
86-
| brotliTest.cpp:26:41:26:44 | **argv | semmle.label | **argv |
87-
| brotliTest.cpp:28:42:28:60 | *access to array | semmle.label | *access to array |
88-
| brotliTest.cpp:34:35:34:40 | *input2 | semmle.label | *input2 |
86+
| brotliTest.cpp:15:41:15:44 | **argv | semmle.label | **argv |
87+
| brotliTest.cpp:15:41:15:44 | **argv | semmle.label | **argv |
88+
| brotliTest.cpp:18:35:18:53 | *access to array | semmle.label | *access to array |
89+
| brotliTest.cpp:21:30:21:52 | *access to array | semmle.label | *access to array |
90+
| brotliTest.cpp:24:51:24:58 | **& ... | semmle.label | **& ... |
8991
| libarchiveTests.cpp:16:31:16:32 | *ar | semmle.label | *ar |
9092
| libarchiveTests.cpp:16:31:16:32 | *ar | semmle.label | *ar |
9193
| libarchiveTests.cpp:22:41:22:42 | *ar | semmle.label | *ar |
@@ -149,16 +151,16 @@ nodes
149151
| zlibTest.cpp:85:19:85:25 | *access to array | semmle.label | *access to array |
150152
subpaths
151153
| libarchiveTests.cpp:38:27:38:27 | *a | libarchiveTests.cpp:16:31:16:32 | *ar | libarchiveTests.cpp:16:31:16:32 | *ar | libarchiveTests.cpp:38:27:38:27 | read_data output argument |
152-
| main.cpp:8:23:8:26 | **argv | brotliTest.cpp:26:41:26:44 | **argv | brotliTest.cpp:26:41:26:44 | **argv | main.cpp:8:23:8:26 | brotli_test output argument |
154+
| main.cpp:8:23:8:26 | **argv | brotliTest.cpp:15:41:15:44 | **argv | brotliTest.cpp:15:41:15:44 | **argv | main.cpp:8:23:8:26 | brotli_test output argument |
153155
| main.cpp:9:27:9:30 | **argv | libarchiveTests.cpp:30:45:30:48 | **argv | libarchiveTests.cpp:30:45:30:48 | **argv | main.cpp:9:27:9:30 | libarchive_test output argument |
154156
| main.cpp:10:24:10:27 | **argv | minizipTest.cpp:12:42:12:45 | **argv | minizipTest.cpp:12:42:12:45 | **argv | main.cpp:10:24:10:27 | minizip_test output argument |
155157
| zlibTest.cpp:81:19:81:25 | *access to array | zlibTest.cpp:47:26:47:33 | *fileName | zlibTest.cpp:47:26:47:33 | *fileName | zlibTest.cpp:81:19:81:25 | UnsafeGzfread output argument |
156158
| zlibTest.cpp:82:18:82:24 | *access to array | zlibTest.cpp:57:25:57:32 | *fileName | zlibTest.cpp:57:25:57:32 | *fileName | zlibTest.cpp:82:18:82:24 | UnsafeGzgets output argument |
157159
| zlibTest.cpp:83:19:83:25 | *access to array | zlibTest.cpp:16:26:16:30 | *input | zlibTest.cpp:16:26:16:30 | *input | zlibTest.cpp:83:19:83:25 | UnsafeInflate output argument |
158160
| zlibTest.cpp:84:18:84:24 | *access to array | zlibTest.cpp:37:25:37:32 | *fileName | zlibTest.cpp:37:25:37:32 | *fileName | zlibTest.cpp:84:18:84:24 | UnsafeGzread output argument |
159161
#select
160-
| brotliTest.cpp:28:42:28:60 | *access to array | main.cpp:7:33:7:36 | **argv | brotliTest.cpp:28:42:28:60 | *access to array | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
161-
| brotliTest.cpp:34:35:34:40 | *input2 | main.cpp:7:33:7:36 | **argv | brotliTest.cpp:34:35:34:40 | *input2 | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
162+
| brotliTest.cpp:18:35:18:53 | *access to array | main.cpp:7:33:7:36 | **argv | brotliTest.cpp:18:35:18:53 | *access to array | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
163+
| brotliTest.cpp:24:51:24:58 | **& ... | main.cpp:7:33:7:36 | **argv | brotliTest.cpp:24:51:24:58 | **& ... | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
162164
| libarchiveTests.cpp:22:41:22:42 | *ar | main.cpp:7:33:7:36 | **argv | libarchiveTests.cpp:22:41:22:42 | *ar | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
163165
| minizipTest.cpp:17:52:17:67 | *access to array | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:17:52:17:67 | *access to array | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |
164166
| minizipTest.cpp:26:30:26:39 | **zip_reader | main.cpp:7:33:7:36 | **argv | minizipTest.cpp:26:30:26:39 | **zip_reader | This Decompression output $@. | main.cpp:7:33:7:36 | **argv | is not limited |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-409/DecompressionBombs/brotliTest.cpp

+16-27
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,26 @@
11
typedef long unsigned int size_t;
22
typedef unsigned char uint8_t;
3-
typedef enum {
4-
} BrotliDecoderResult;
53

6-
BrotliDecoderResult BrotliDecoderDecompress(
7-
size_t encoded_size,
8-
const uint8_t encoded_buffer[],
9-
size_t *decoded_size,
10-
uint8_t decoded_buffer[]) { return static_cast<BrotliDecoderResult>(0); };
11-
12-
void strncpy(char *string, const char *string1, int i);
4+
enum BrotliDecoderResult {};
5+
struct BrotliDecoderState;
136

14-
typedef struct BrotliDecoderStateStruct BrotliDecoderState;
7+
BrotliDecoderResult BrotliDecoderDecompress(
8+
size_t encoded_size, const uint8_t encoded_buffer[],
9+
size_t *decoded_size, uint8_t decoded_buffer[]);
1510

1611
BrotliDecoderResult BrotliDecoderDecompressStream(
1712
BrotliDecoderState *state, size_t *available_in, const uint8_t **next_in,
18-
size_t *available_out, uint8_t **next_out, size_t *total_out) { return static_cast<BrotliDecoderResult>(0); };
19-
20-
namespace std {
21-
void strncpy(char *string, const char *string1, int i) {
22-
23-
}
24-
}
13+
size_t *available_out, uint8_t **next_out, size_t *total_out);
2514

2615
void brotli_test(int argc, const char **argv) {
27-
uint8_t *output = nullptr;
28-
BrotliDecoderDecompress(1024 * 1024, (uint8_t *) argv[2], // BAD
29-
reinterpret_cast<size_t *>(1024 * 1024 * 1024), output);
30-
uint8_t **output2 = nullptr;
31-
const uint8_t **input2 = nullptr;
32-
std::strncpy(reinterpret_cast<char *>(input2), argv[2], 32);
33-
BrotliDecoderDecompressStream(0, reinterpret_cast<size_t *>(1024 * 1024),
34-
input2, reinterpret_cast<size_t *>(1024 * 1024 * 1024), // BAD
35-
output2,
36-
reinterpret_cast<size_t *>(1024 * 1024 * 1024));
16+
uint8_t output[1024];
17+
size_t output_size = sizeof(output);
18+
BrotliDecoderDecompress(1024, (uint8_t *) argv[2], &output_size, output); // BAD
19+
20+
size_t input_size = 1024;
21+
const uint8_t *input_p = (const uint8_t*)argv[2];
22+
uint8_t *output_p = output;
23+
size_t out_size;
24+
BrotliDecoderDecompressStream(0, &input_size, &input_p, &output_size, // BAD
25+
&output_p, &out_size);
3726
}

0 commit comments

Comments
 (0)