Skip to content

Commit aac5287

Browse files
mbaludambaluda
authored
Merge branch 'github:main' into prompt-injection
2 parents 82c6a23 + 46a5035 commit aac5287

File tree

5 files changed

+52
-48
lines changed

5 files changed

+52
-48
lines changed

‎cpp/ql/lib/change-notes/2026-01-26-buffer-overflow-fps.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The `Buffer.qll` library will no longer report incorrect buffer sizes on certain malformed databases. As a result, the queries `cpp/static-buffer-overflow`, `cpp/overflow-buffer`, `cpp/badly-bounded-write`, `cpp/overrunning-write`, `cpp/overrunning-write-with-float`, and `cpp/very-likely-overrunning-write` will report fewer false positives on such databases.

‎cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,13 @@ private Class getRootType(FieldAccess fa) {
6262
* unspecified type of `v` is a `ReferenceType`.
6363
*/
6464
private int getVariableSize(Variable v) {
65-
exists(Type t |
66-
t = v.getUnspecifiedType() and
67-
not t instanceof ReferenceType and
68-
result = t.getSize()
69-
)
65+
result =
66+
unique(Type t |
67+
t = v.getUnspecifiedType() and
68+
not t instanceof ReferenceType
69+
|
70+
t.getSize()
71+
)
7072
}
7173

7274
/**
@@ -79,30 +81,32 @@ private int getSize(VariableAccess va) {
7981
not v instanceof Field and
8082
result = getVariableSize(v)
8183
or
82-
exists(Class c, int trueSize |
83-
// Otherwise, we find the "outermost" object and compute the size
84-
// as the difference between the size of the type of the "outermost
85-
// object" and the offset of the field relative to that type.
86-
// For example, consider the following structs:
87-
// ```
88-
// struct S {
89-
// uint32_t x;
90-
// uint32_t y;
91-
// };
92-
// struct S2 {
93-
// S s;
94-
// uint32_t z;
95-
// };
96-
// ```
97-
// Given an object `S2 s2` the size of the buffer `&s2.s.y`
98-
// is the size of the base object type (i.e., `S2`) minutes the offset
99-
// of `y` relative to the type `S2` (i.e., `4`). So the size of the
100-
// buffer is `12 - 4 = 8`.
101-
c = getRootType(va) and
102-
// we calculate the size based on the last field, to avoid including any padding after it
103-
trueSize = max(Field f | | f.getOffsetInClass(c) + getVariableSize(f)) and
104-
result = trueSize - v.(Field).getOffsetInClass(c)
105-
)
84+
result =
85+
unique(Class c, int trueSize |
86+
// Otherwise, we find the "outermost" object and compute the size
87+
// as the difference between the size of the type of the "outermost
88+
// object" and the offset of the field relative to that type.
89+
// For example, consider the following structs:
90+
// ```
91+
// struct S {
92+
// uint32_t x;
93+
// uint32_t y;
94+
// };
95+
// struct S2 {
96+
// S s;
97+
// uint32_t z;
98+
// };
99+
// ```
100+
// Given an object `S2 s2` the size of the buffer `&s2.s.y`
101+
// is the size of the base object type (i.e., `S2`) minus the offset
102+
// of `y` relative to the type `S2` (i.e., `4`). So the size of the
103+
// buffer is `12 - 4 = 8`.
104+
c = getRootType(va) and
105+
// we calculate the size based on the last field, to avoid including any padding after it
106+
trueSize = max(Field f | | f.getOffsetInClass(c) + getVariableSize(f))
107+
|
108+
trueSize - v.(Field).getOffsetInClass(c)
109+
)
106110
)
107111
}
108112

@@ -116,12 +120,8 @@ private int isSource(Expr bufferExpr, Element why) {
116120
exists(Variable bufferVar | bufferVar = bufferExpr.(VariableAccess).getTarget() |
117121
// buffer is a fixed size array
118122
exists(bufferVar.getUnspecifiedType().(ArrayType).getSize()) and
119-
result =
120-
unique(int size | // more generous than .getSize() itself, when the array is a class field or similar.
121-
size = getSize(bufferExpr)
122-
|
123-
size
124-
) and
123+
// more generous than .getSize() itself, when the array is a class field or similar.
124+
result = getSize(bufferExpr) and
125125
why = bufferVar and
126126
not memberMayBeVarSize(_, bufferVar) and
127127
not exists(BuiltInOperationBuiltInOffsetOf offsetof | offsetof.getAChild*() = bufferExpr) and

‎cpp/ql/lib/semmle/code/cpp/internal/Overlay.qll‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,13 @@ private string getSingleLocationFilePath(@element e) {
4545
overlay[local]
4646
private string getMultiLocationFilePath(@element e) {
4747
exists(@location_default loc |
48-
exists(@var_decl vd | var_decls(vd, e, _, _, loc))
48+
var_decls(_, e, _, _, loc)
4949
or
50-
exists(@fun_decl fd | fun_decls(fd, e, _, _, loc))
50+
fun_decls(_, e, _, _, loc)
5151
or
52-
exists(@type_decl td | type_decls(td, e, loc))
52+
type_decls(_, e, loc)
5353
or
54-
exists(@namespace_decl nd | namespace_decls(nd, e, loc, _))
54+
namespace_decls(_, e, loc, _)
5555
|
5656
result = getLocationFilePath(loc)
5757
)
@@ -62,7 +62,7 @@ private string getMultiLocationFilePath(@element e) {
6262
* overlay variant.
6363
*/
6464
overlay[local]
65-
private predicate holdsInBase() { not isOverlay() }
65+
private predicate isBase() { not isOverlay() }
6666

6767
/**
6868
* Discards an element from the base variant if:
@@ -71,7 +71,7 @@ private predicate holdsInBase() { not isOverlay() }
7171
*/
7272
overlay[discard_entity]
7373
private predicate discardElement(@element e) {
74-
holdsInBase() and
74+
isBase() and
7575
(
7676
overlayChangedFiles(getSingleLocationFilePath(e))
7777
or

‎java/documentation/library-coverage/coverage.csv‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ java.security,21,,583,,,11,10,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,285,29
9696
java.sql,15,1,292,,,,1,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,,9,,,,,,,,,,1,,,,274,18
9797
java.text,,,154,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,72,82
9898
java.time,,,131,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,27,104
99-
java.util,48,2,1339,,,,,,,,,1,,,,,,,,,,,34,,,,3,,,,5,2,,1,2,,,,,,,,,,,,,,2,,,558,781
99+
java.util,48,2,1340,,,,,,,,,1,,,,,,,,,,,34,,,,3,,,,5,2,,1,2,,,,,,,,,,,,,,2,,,558,782
100100
javafx.scene.web,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,
101101
javax.accessibility,,,63,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,28,35
102102
javax.activation,2,,7,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,1,,,,,,,,,,,,,,,,7,
@@ -153,7 +153,7 @@ org.acegisecurity,,,49,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,49,
153153
org.antlr.runtime,1,,,,,,,,,,,,,,,,,,,,,,,,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,
154154
org.apache.commons.codec,,,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,6,
155155
org.apache.commons.collections,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
156-
org.apache.commons.collections4,,,800,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,783
156+
org.apache.commons.collections4,,,806,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,17,789
157157
org.apache.commons.compress.archivers.tar,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,4,
158158
org.apache.commons.exec,10,,,,6,,,,,,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
159159
org.apache.commons.fileupload,,11,4,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,11,4,
@@ -262,7 +262,7 @@ org.springframework.web.portlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,
262262
org.springframework.web.reactive.function.client,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,,,,,
263263
org.springframework.web.servlet,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,
264264
org.springframework.web.socket,,8,6,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,8,6,
265-
org.springframework.web.util,,9,157,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,132,25
265+
org.springframework.web.util,,9,159,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,9,134,25
266266
org.thymeleaf,2,,2,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,2,,,,,,,,,,,,,2,
267267
org.xml.sax,,,1,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1,
268268
org.xmlpull.v1,,3,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,3,,

‎java/documentation/library-coverage/coverage.rst‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ Java framework & library support
99
Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE‑022` :sub:`Path injection`,`CWE‑079` :sub:`Cross-site scripting`,`CWE‑089` :sub:`SQL injection`,`CWE‑090` :sub:`LDAP injection`,`CWE‑094` :sub:`Code injection`,`CWE‑918` :sub:`Request Forgery`
1010
Android,``android.*``,52,481,181,1,3,67,,,
1111
Android extensions,``androidx.*``,5,183,60,,,,,,
12-
`Apache Commons Collections <https://commons.apache.org/proper/commons-collections/>`_,"``org.apache.commons.collections``, ``org.apache.commons.collections4``",,1600,,,,,,,
12+
`Apache Commons Collections <https://commons.apache.org/proper/commons-collections/>`_,"``org.apache.commons.collections``, ``org.apache.commons.collections4``",,1606,,,,,,,
1313
`Apache Commons IO <https://commons.apache.org/proper/commons-io/>`_,``org.apache.commons.io``,,570,124,105,,,,,15
1414
`Apache Commons Lang <https://commons.apache.org/proper/commons-lang/>`_,``org.apache.commons.lang3``,,425,7,,,,,,
1515
`Apache Commons Text <https://commons.apache.org/proper/commons-text/>`_,``org.apache.commons.text``,,272,,,,,,,
@@ -26,7 +26,7 @@ Java framework & library support
2626
`JBoss Logging <https://github.com/jboss-logging/jboss-logging>`_,``org.jboss.logging``,,,324,,,,,,
2727
`JSON-java <https://github.com/stleary/JSON-java>`_,``org.json``,,236,,,,,,,
2828
`Jackson <https://github.com/FasterXML/jackson>`_,``com.fasterxml.jackson.*``,,9,2,2,,,,,
29-
Java Standard Library,``java.*``,10,4628,260,99,,9,,,26
29+
Java Standard Library,``java.*``,10,4629,260,99,,9,,,26
3030
Java extensions,"``javax.*``, ``jakarta.*``",101,4185,90,10,4,2,1,1,4
3131
`Jetty <https://eclipse.dev/jetty/>`_,``org.eclipse.jetty.client``,,,2,,,,,,2
3232
Kotlin Standard Library,``kotlin*``,,1849,16,14,,,,,2
@@ -37,9 +37,9 @@ Java framework & library support
3737
`Retrofit <https://square.github.io/retrofit/>`_,``retrofit2``,,1,1,,,,,,1
3838
`SLF4J <https://www.slf4j.org/>`_,``org.slf4j``,,6,55,,,,,,
3939
`SnakeYAML <https://github.com/snakeyaml/snakeyaml>`_,``org.yaml.snakeyaml``,,1,,,,,,,
40-
`Spring <https://spring.io/>`_,``org.springframework.*``,46,492,143,26,,28,14,,35
40+
`Spring <https://spring.io/>`_,``org.springframework.*``,46,494,143,26,,28,14,,35
4141
`Thymeleaf <https://www.thymeleaf.org/>`_,``org.thymeleaf``,,2,2,,,,,,
4242
`jOOQ <https://www.jooq.org/>`_,``org.jooq``,,,1,,,1,,,
4343
Others,"``actions.osgi``, ``antlr``, ``ch.ethz.ssh2``, ``cn.hutool.core.codec``, ``com.alibaba.com.caucho.hessian.io``, ``com.alibaba.druid.sql``, ``com.alibaba.fastjson2``, ``com.amazonaws.auth``, ``com.auth0.jwt.algorithms``, ``com.azure.identity``, ``com.caucho.burlap.io``, ``com.caucho.hessian.io``, ``com.cedarsoftware.util.io``, ``com.esotericsoftware.kryo.io``, ``com.esotericsoftware.kryo5.io``, ``com.esotericsoftware.yamlbeans``, ``com.hubspot.jinjava``, ``com.jcraft.jsch``, ``com.microsoft.sqlserver.jdbc``, ``com.mitchellbosecke.pebble``, ``com.opensymphony.xwork2``, ``com.sshtools.j2ssh.authentication``, ``com.sun.crypto.provider``, ``com.sun.jndi.ldap``, ``com.sun.net.httpserver``, ``com.sun.net.ssl``, ``com.sun.rowset``, ``com.sun.security.auth.module``, ``com.sun.security.ntlm``, ``com.sun.security.sasl.digest``, ``com.thoughtworks.xstream``, ``com.trilead.ssh2``, ``com.unboundid.ldap.sdk``, ``com.zaxxer.hikari``, ``flexjson``, ``hudson``, ``io.jsonwebtoken``, ``io.undertow.server.handlers.resource``, ``javafx.scene.web``, ``jenkins``, ``jodd.json``, ``liquibase.database.jvm``, ``liquibase.statement.core``, ``net.lingala.zip4j``, ``net.schmizz.sshj``, ``net.sf.json``, ``net.sf.saxon.s9api``, ``ognl``, ``org.acegisecurity``, ``org.antlr.runtime``, ``org.apache.commons.codec``, ``org.apache.commons.compress.archivers.tar``, ``org.apache.commons.exec``, ``org.apache.commons.fileupload``, ``org.apache.commons.httpclient.util``, ``org.apache.commons.jelly``, ``org.apache.commons.jexl2``, ``org.apache.commons.jexl3``, ``org.apache.commons.lang``, ``org.apache.commons.logging``, ``org.apache.commons.net``, ``org.apache.commons.ognl``, ``org.apache.cxf.catalog``, ``org.apache.cxf.common.classloader``, ``org.apache.cxf.common.jaxb``, ``org.apache.cxf.common.logging``, ``org.apache.cxf.configuration.jsse``, ``org.apache.cxf.helpers``, ``org.apache.cxf.resource``, ``org.apache.cxf.staxutils``, ``org.apache.cxf.tools.corba.utils``, ``org.apache.cxf.tools.util``, ``org.apache.cxf.transform``, ``org.apache.directory.ldap.client.api``, ``org.apache.hadoop.fs``, ``org.apache.hadoop.hive.metastore``, ``org.apache.hadoop.hive.ql.exec``, ``org.apache.hadoop.hive.ql.metadata``, ``org.apache.hc.client5.http.async.methods``, ``org.apache.hc.client5.http.classic.methods``, ``org.apache.hc.client5.http.fluent``, ``org.apache.hive.hcatalog.templeton``, ``org.apache.ibatis.jdbc``, ``org.apache.ibatis.mapping``, ``org.apache.log4j``, ``org.apache.shiro.authc``, ``org.apache.shiro.codec``, ``org.apache.shiro.jndi``, ``org.apache.shiro.mgt``, ``org.apache.sshd.client.session``, ``org.apache.tools.ant``, ``org.apache.tools.zip``, ``org.codehaus.cargo.container.installer``, ``org.dom4j``, ``org.exolab.castor.xml``, ``org.fusesource.leveldbjni``, ``org.geogebra.web.full.main``, ``org.gradle.api.file``, ``org.ho.yaml``, ``org.influxdb``, ``org.jabsorb``, ``org.jboss.vfs``, ``org.jdbi.v3.core``, ``org.jenkins.ui.icon``, ``org.jenkins.ui.symbol``, ``org.keycloak.models.map.storage``, ``org.kohsuke.stapler``, ``org.lastaflute.web``, ``org.mvel2``, ``org.openjdk.jmh.runner.options``, ``org.owasp.esapi``, ``org.pac4j.jwt.config.encryption``, ``org.pac4j.jwt.config.signature``, ``org.scijava.log``, ``org.xml.sax``, ``org.xmlpull.v1``, ``play.libs.ws``, ``play.mvc``, ``ratpack.core.form``, ``ratpack.core.handling``, ``ratpack.core.http``, ``ratpack.exec``, ``ratpack.form``, ``ratpack.func``, ``ratpack.handling``, ``ratpack.http``, ``ratpack.util``, ``software.amazon.awssdk.transfer.s3.model``, ``sun.jvmstat.perfdata.monitor.protocol.local``, ``sun.jvmstat.perfdata.monitor.protocol.rmi``, ``sun.misc``, ``sun.net.ftp``, ``sun.net.www.protocol.http``, ``sun.security.acl``, ``sun.security.jgss.krb5``, ``sun.security.krb5``, ``sun.security.pkcs``, ``sun.security.pkcs11``, ``sun.security.provider``, ``sun.security.ssl``, ``sun.security.x509``, ``sun.tools.jconsole``",108,6034,757,131,6,14,18,,185
44-
Totals,,363,26372,2681,404,16,134,33,1,409
44+
Totals,,363,26381,2681,404,16,134,33,1,409
4545

0 commit comments

Comments
 (0)