Skip to content

Commit 7ceb764

Browse files
geoffw0geoffw0
committed
Rust: Improve the source to account for conversions.
1 parent be6d0d1 commit 7ceb764

File tree

3 files changed

+61
-37
lines changed

3 files changed

+61
-37
lines changed

‎rust/ql/lib/codeql/rust/security/AccessInvalidPointerExtensions.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ module AccessInvalidPointer {
5050
sourceNode(n, "pointer-invalidate") and
5151
n.(FlowSummaryNode).getSourceElement() = ce.getFunction() and
5252
arg = ce.getArgList().getAnArg() and
53-
this.asExpr().getExpr() = arg
53+
this.asExpr().getExpr().getParentNode*() = arg
5454
)
5555
}
5656
}

‎rust/ql/test/query-tests/security/CWE-825/AccessInvalidPointer.expected‎

Lines changed: 50 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,16 @@
33
| deallocation.rs:25:12:25:31 | ...::read::<...> | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:25:12:25:31 | ...::read::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
44
| deallocation.rs:33:5:33:6 | m1 | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:33:5:33:6 | m1 | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
55
| deallocation.rs:35:4:35:24 | ...::write::<...> | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:35:4:35:24 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
6-
| deallocation.rs:97:14:97:15 | p1 | deallocation.rs:90:23:90:40 | ...::dangling | deallocation.rs:97:14:97:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:90:23:90:40 | ...::dangling | invalid |
7-
| deallocation.rs:98:14:98:15 | p2 | deallocation.rs:91:21:91:42 | ...::dangling_mut | deallocation.rs:98:14:98:15 | p2 | This operation dereferences a pointer that may be $@. | deallocation.rs:91:21:91:42 | ...::dangling_mut | invalid |
8-
| deallocation.rs:99:14:99:15 | p3 | deallocation.rs:92:23:92:36 | ...::null | deallocation.rs:99:14:99:15 | p3 | This operation dereferences a pointer that may be $@. | deallocation.rs:92:23:92:36 | ...::null | invalid |
9-
| deallocation.rs:146:14:146:15 | p1 | deallocation.rs:143:27:143:28 | p1 | deallocation.rs:146:14:146:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:143:27:143:28 | p1 | invalid |
6+
| deallocation.rs:57:14:57:15 | m2 | deallocation.rs:54:23:54:24 | m2 | deallocation.rs:57:14:57:15 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:54:23:54:24 | m2 | invalid |
7+
| deallocation.rs:58:14:58:15 | m2 | deallocation.rs:54:23:54:24 | m2 | deallocation.rs:58:14:58:15 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:54:23:54:24 | m2 | invalid |
8+
| deallocation.rs:63:6:63:7 | m2 | deallocation.rs:54:23:54:24 | m2 | deallocation.rs:63:6:63:7 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:54:23:54:24 | m2 | invalid |
9+
| deallocation.rs:64:6:64:7 | m2 | deallocation.rs:54:23:54:24 | m2 | deallocation.rs:64:6:64:7 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:54:23:54:24 | m2 | invalid |
10+
| deallocation.rs:66:4:66:30 | ...::write::<...> | deallocation.rs:54:23:54:24 | m2 | deallocation.rs:66:4:66:30 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:54:23:54:24 | m2 | invalid |
11+
| deallocation.rs:84:13:84:18 | my_ptr | deallocation.rs:81:14:81:19 | my_ptr | deallocation.rs:84:13:84:18 | my_ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:81:14:81:19 | my_ptr | invalid |
12+
| deallocation.rs:99:14:99:15 | p1 | deallocation.rs:92:23:92:40 | ...::dangling | deallocation.rs:99:14:99:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:92:23:92:40 | ...::dangling | invalid |
13+
| deallocation.rs:100:14:100:15 | p2 | deallocation.rs:93:21:93:42 | ...::dangling_mut | deallocation.rs:100:14:100:15 | p2 | This operation dereferences a pointer that may be $@. | deallocation.rs:93:21:93:42 | ...::dangling_mut | invalid |
14+
| deallocation.rs:101:14:101:15 | p3 | deallocation.rs:94:23:94:36 | ...::null | deallocation.rs:101:14:101:15 | p3 | This operation dereferences a pointer that may be $@. | deallocation.rs:94:23:94:36 | ...::null | invalid |
15+
| deallocation.rs:148:14:148:15 | p1 | deallocation.rs:145:27:145:28 | p1 | deallocation.rs:148:14:148:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:145:27:145:28 | p1 | invalid |
1016
edges
1117
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:23:13:23:14 | m1 | provenance | |
1218
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:25:33:25:34 | m1 | provenance | |
@@ -15,16 +21,23 @@ edges
1521
| deallocation.rs:25:33:25:34 | m1 | deallocation.rs:33:5:33:6 | m1 | provenance | |
1622
| deallocation.rs:33:5:33:6 | m1 | deallocation.rs:35:26:35:27 | m1 | provenance | |
1723
| deallocation.rs:35:26:35:27 | m1 | deallocation.rs:35:4:35:24 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
18-
| deallocation.rs:90:6:90:7 | p1 | deallocation.rs:97:14:97:15 | p1 | provenance | |
19-
| deallocation.rs:90:23:90:40 | ...::dangling | deallocation.rs:90:23:90:42 | ...::dangling(...) | provenance | Src:MaD:3 MaD:3 |
20-
| deallocation.rs:90:23:90:42 | ...::dangling(...) | deallocation.rs:90:6:90:7 | p1 | provenance | |
21-
| deallocation.rs:91:6:91:7 | p2 | deallocation.rs:98:14:98:15 | p2 | provenance | |
22-
| deallocation.rs:91:21:91:42 | ...::dangling_mut | deallocation.rs:91:21:91:44 | ...::dangling_mut(...) | provenance | Src:MaD:4 MaD:4 |
23-
| deallocation.rs:91:21:91:44 | ...::dangling_mut(...) | deallocation.rs:91:6:91:7 | p2 | provenance | |
24-
| deallocation.rs:92:6:92:7 | p3 | deallocation.rs:99:14:99:15 | p3 | provenance | |
25-
| deallocation.rs:92:23:92:36 | ...::null | deallocation.rs:92:23:92:38 | ...::null(...) | provenance | Src:MaD:5 MaD:5 |
26-
| deallocation.rs:92:23:92:38 | ...::null(...) | deallocation.rs:92:6:92:7 | p3 | provenance | |
27-
| deallocation.rs:143:27:143:28 | p1 | deallocation.rs:146:14:146:15 | p1 | provenance | |
24+
| deallocation.rs:54:23:54:24 | m2 | deallocation.rs:57:14:57:15 | m2 | provenance | |
25+
| deallocation.rs:54:23:54:24 | m2 | deallocation.rs:58:14:58:15 | m2 | provenance | |
26+
| deallocation.rs:54:23:54:24 | m2 | deallocation.rs:63:6:63:7 | m2 | provenance | |
27+
| deallocation.rs:54:23:54:24 | m2 | deallocation.rs:64:6:64:7 | m2 | provenance | |
28+
| deallocation.rs:54:23:54:24 | m2 | deallocation.rs:66:32:66:33 | m2 | provenance | |
29+
| deallocation.rs:66:32:66:33 | m2 | deallocation.rs:66:4:66:30 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
30+
| deallocation.rs:81:14:81:19 | my_ptr | deallocation.rs:84:13:84:18 | my_ptr | provenance | |
31+
| deallocation.rs:92:6:92:7 | p1 | deallocation.rs:99:14:99:15 | p1 | provenance | |
32+
| deallocation.rs:92:23:92:40 | ...::dangling | deallocation.rs:92:23:92:42 | ...::dangling(...) | provenance | Src:MaD:3 MaD:3 |
33+
| deallocation.rs:92:23:92:42 | ...::dangling(...) | deallocation.rs:92:6:92:7 | p1 | provenance | |
34+
| deallocation.rs:93:6:93:7 | p2 | deallocation.rs:100:14:100:15 | p2 | provenance | |
35+
| deallocation.rs:93:21:93:42 | ...::dangling_mut | deallocation.rs:93:21:93:44 | ...::dangling_mut(...) | provenance | Src:MaD:4 MaD:4 |
36+
| deallocation.rs:93:21:93:44 | ...::dangling_mut(...) | deallocation.rs:93:6:93:7 | p2 | provenance | |
37+
| deallocation.rs:94:6:94:7 | p3 | deallocation.rs:101:14:101:15 | p3 | provenance | |
38+
| deallocation.rs:94:23:94:36 | ...::null | deallocation.rs:94:23:94:38 | ...::null(...) | provenance | Src:MaD:5 MaD:5 |
39+
| deallocation.rs:94:23:94:38 | ...::null(...) | deallocation.rs:94:6:94:7 | p3 | provenance | |
40+
| deallocation.rs:145:27:145:28 | p1 | deallocation.rs:148:14:148:15 | p1 | provenance | |
2841
models
2942
| 1 | Sink: lang:core; crate::ptr::read; pointer-access; Argument[0] |
3043
| 2 | Sink: lang:core; crate::ptr::write; pointer-access; Argument[0] |
@@ -40,18 +53,27 @@ nodes
4053
| deallocation.rs:33:5:33:6 | m1 | semmle.label | m1 |
4154
| deallocation.rs:35:4:35:24 | ...::write::<...> | semmle.label | ...::write::<...> |
4255
| deallocation.rs:35:26:35:27 | m1 | semmle.label | m1 |
43-
| deallocation.rs:90:6:90:7 | p1 | semmle.label | p1 |
44-
| deallocation.rs:90:23:90:40 | ...::dangling | semmle.label | ...::dangling |
45-
| deallocation.rs:90:23:90:42 | ...::dangling(...) | semmle.label | ...::dangling(...) |
46-
| deallocation.rs:91:6:91:7 | p2 | semmle.label | p2 |
47-
| deallocation.rs:91:21:91:42 | ...::dangling_mut | semmle.label | ...::dangling_mut |
48-
| deallocation.rs:91:21:91:44 | ...::dangling_mut(...) | semmle.label | ...::dangling_mut(...) |
49-
| deallocation.rs:92:6:92:7 | p3 | semmle.label | p3 |
50-
| deallocation.rs:92:23:92:36 | ...::null | semmle.label | ...::null |
51-
| deallocation.rs:92:23:92:38 | ...::null(...) | semmle.label | ...::null(...) |
52-
| deallocation.rs:97:14:97:15 | p1 | semmle.label | p1 |
53-
| deallocation.rs:98:14:98:15 | p2 | semmle.label | p2 |
54-
| deallocation.rs:99:14:99:15 | p3 | semmle.label | p3 |
55-
| deallocation.rs:143:27:143:28 | p1 | semmle.label | p1 |
56-
| deallocation.rs:146:14:146:15 | p1 | semmle.label | p1 |
56+
| deallocation.rs:54:23:54:24 | m2 | semmle.label | m2 |
57+
| deallocation.rs:57:14:57:15 | m2 | semmle.label | m2 |
58+
| deallocation.rs:58:14:58:15 | m2 | semmle.label | m2 |
59+
| deallocation.rs:63:6:63:7 | m2 | semmle.label | m2 |
60+
| deallocation.rs:64:6:64:7 | m2 | semmle.label | m2 |
61+
| deallocation.rs:66:4:66:30 | ...::write::<...> | semmle.label | ...::write::<...> |
62+
| deallocation.rs:66:32:66:33 | m2 | semmle.label | m2 |
63+
| deallocation.rs:81:14:81:19 | my_ptr | semmle.label | my_ptr |
64+
| deallocation.rs:84:13:84:18 | my_ptr | semmle.label | my_ptr |
65+
| deallocation.rs:92:6:92:7 | p1 | semmle.label | p1 |
66+
| deallocation.rs:92:23:92:40 | ...::dangling | semmle.label | ...::dangling |
67+
| deallocation.rs:92:23:92:42 | ...::dangling(...) | semmle.label | ...::dangling(...) |
68+
| deallocation.rs:93:6:93:7 | p2 | semmle.label | p2 |
69+
| deallocation.rs:93:21:93:42 | ...::dangling_mut | semmle.label | ...::dangling_mut |
70+
| deallocation.rs:93:21:93:44 | ...::dangling_mut(...) | semmle.label | ...::dangling_mut(...) |
71+
| deallocation.rs:94:6:94:7 | p3 | semmle.label | p3 |
72+
| deallocation.rs:94:23:94:36 | ...::null | semmle.label | ...::null |
73+
| deallocation.rs:94:23:94:38 | ...::null(...) | semmle.label | ...::null(...) |
74+
| deallocation.rs:99:14:99:15 | p1 | semmle.label | p1 |
75+
| deallocation.rs:100:14:100:15 | p2 | semmle.label | p2 |
76+
| deallocation.rs:101:14:101:15 | p3 | semmle.label | p3 |
77+
| deallocation.rs:145:27:145:28 | p1 | semmle.label | p1 |
78+
| deallocation.rs:148:14:148:15 | p1 | semmle.label | p1 |
5779
subpaths

‎rust/ql/test/query-tests/security/CWE-825/deallocation.rs‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -51,18 +51,19 @@ pub fn test_alloc_array(do_dangerous_writes: bool) {
5151
println!(" v1 = {v1}");
5252
println!(" v2 = {v2}");
5353

54-
std::alloc::dealloc(m2 as *mut u8, layout); // m1, m2 are now dangling
54+
std::alloc::dealloc(m2 as *mut u8, layout); // $ Source=dealloc_array
55+
// m1, m2 are now dangling
5556

56-
let v3 = (*m2)[0]; // $ MISSING: Alert
57-
let v4 = (*m2)[1]; // $ MISSING: Alert
57+
let v3 = (*m2)[0]; // $ Alert[rust/access-invalid-pointer]=dealloc_array
58+
let v4 = (*m2)[1]; // $ Alert[rust/access-invalid-pointer]=dealloc_array
5859
println!(" v3 = {v3} (!)"); // corrupt in practice
5960
println!(" v4 = {v4} (!)"); // corrupt in practice
6061

6162
if do_dangerous_writes {
62-
(*m2)[0] = 3; // $ MISSING: Alert
63-
(*m2)[1] = 4; // $ MISSING: Alert
63+
(*m2)[0] = 3; // $ Alert[rust/access-invalid-pointer]=dealloc_array
64+
(*m2)[1] = 4; // $ Alert[rust/access-invalid-pointer]=dealloc_array
6465
std::ptr::write::<u8>(m1, 5); // $ MISSING: Alert
65-
std::ptr::write::<[u8; 10]>(m2, [6; 10]); // $ MISSING: Alert
66+
std::ptr::write::<[u8; 10]>(m2, [6; 10]); // $ Alert[rust/access-invalid-pointer]=dealloc_array
6667
}
6768
}
6869
}
@@ -77,9 +78,10 @@ pub fn test_libc() {
7778
let v1 = *my_ptr; // GOOD
7879
println!(" v1 = {v1}");
7980

80-
libc::free(my_ptr as *mut libc::c_void); // my_ptr is now dangling
81+
libc::free(my_ptr as *mut libc::c_void); // $ Source=free
82+
// (my_ptr is now dangling)
8183

82-
let v2 = *my_ptr; // $ MISSING: Alert
84+
let v2 = *my_ptr; // $ Alert[rust/access-invalid-pointer]=free
8385
println!(" v2 = {v2} (!)"); // corrupt in practice
8486
}
8587
}

0 commit comments

Comments
 (0)