From d5d04f2f4c68145b70e99b27efa3efbf996ec103 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Mon, 8 Jul 2024 14:08:52 +0100 Subject: [PATCH] C++: Add a 'cpp/unsafe-strncat' FP. --- .../SuspiciousCallToStrncat.expected | 2 ++ .../SuspiciousCallToStrncat/test.c | 17 +++++++++++++++++ 2 files changed, 19 insertions(+) diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.expected b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.expected index 114cddb11a5d..337bd8f9bc55 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.expected +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/SuspiciousCallToStrncat.expected @@ -3,3 +3,5 @@ | test.c:67:3:67:9 | call to strncat | Potentially unsafe call to strncat. | | test.c:75:3:75:9 | call to strncat | Potentially unsafe call to strncat. | | test.c:76:3:76:9 | call to strncat | Potentially unsafe call to strncat. | +| test.c:91:3:91:9 | call to strncat | Potentially unsafe call to strncat. | +| test.c:99:3:99:9 | call to strncat | Potentially unsafe call to strncat. | diff --git a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c index f166e5c5ab91..13c18b75dbb4 100644 --- a/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c +++ b/cpp/ql/test/query-tests/Likely Bugs/Memory Management/SuspiciousCallToStrncat/test.c @@ -82,3 +82,20 @@ void strncat_test5(char *s) { strncat(buf, s, len - strlen(buf) - 1); // GOOD strncat(buf, s, len - strlen(buf)); // GOOD } + +void strncat_test6() { + { + char dest[60]; + dest[0] = '\0'; + // Will write `dest[0 .. 5]` + strncat(dest, "small", sizeof(dest)); // GOOD [FALSE POSITIVE] + } + + { + char dest[60]; + memset(dest, 'a', sizeof(dest)); + dest[54] = '\0'; + // Will write `dest[54 .. 59]` + strncat(dest, "small", sizeof(dest)); // GOOD [FALSE POSITIVE] + } +} \ No newline at end of file