Skip to content

Commit b7044bd

Browse files
geoffw0geoffw0
committed
Rust: Add a test of repeat sinks.
1 parent f582054 commit b7044bd

File tree

2 files changed

+76
-66
lines changed

2 files changed

+76
-66
lines changed

‎rust/ql/test/query-tests/security/CWE-825/AccessInvalidPointer.expected‎

Lines changed: 72 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,48 @@
11
#select
22
| deallocation.rs:26:15:26:16 | m1 | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:26:15:26:16 | m1 | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
3-
| deallocation.rs:33:14:33:33 | ...::read::<...> | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:33:14:33:33 | ...::read::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
4-
| deallocation.rs:40:6:40:7 | m1 | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:40:6:40:7 | m1 | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
5-
| deallocation.rs:45:5:45:25 | ...::write::<...> | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:45:5:45:25 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
6-
| deallocation.rs:72:16:72:17 | m2 | deallocation.rs:66:23:66:24 | m2 | deallocation.rs:72:16:72:17 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:66:23:66:24 | m2 | invalid |
7-
| deallocation.rs:77:16:77:17 | m2 | deallocation.rs:66:23:66:24 | m2 | deallocation.rs:77:16:77:17 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:66:23:66:24 | m2 | invalid |
8-
| deallocation.rs:82:7:82:8 | m2 | deallocation.rs:66:23:66:24 | m2 | deallocation.rs:82:7:82:8 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:66:23:66:24 | m2 | invalid |
9-
| deallocation.rs:86:7:86:8 | m2 | deallocation.rs:66:23:66:24 | m2 | deallocation.rs:86:7:86:8 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:66:23:66:24 | m2 | invalid |
10-
| deallocation.rs:91:5:91:31 | ...::write::<...> | deallocation.rs:66:23:66:24 | m2 | deallocation.rs:91:5:91:31 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:66:23:66:24 | m2 | invalid |
11-
| deallocation.rs:111:13:111:18 | my_ptr | deallocation.rs:108:14:108:19 | my_ptr | deallocation.rs:111:13:111:18 | my_ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:108:14:108:19 | my_ptr | invalid |
12-
| deallocation.rs:126:14:126:15 | p1 | deallocation.rs:119:23:119:40 | ...::dangling | deallocation.rs:126:14:126:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:119:23:119:40 | ...::dangling | invalid |
13-
| deallocation.rs:127:14:127:15 | p2 | deallocation.rs:120:21:120:42 | ...::dangling_mut | deallocation.rs:127:14:127:15 | p2 | This operation dereferences a pointer that may be $@. | deallocation.rs:120:21:120:42 | ...::dangling_mut | invalid |
14-
| deallocation.rs:128:14:128:15 | p3 | deallocation.rs:121:23:121:36 | ...::null | deallocation.rs:128:14:128:15 | p3 | This operation dereferences a pointer that may be $@. | deallocation.rs:121:23:121:36 | ...::null | invalid |
15-
| deallocation.rs:176:15:176:16 | p1 | deallocation.rs:172:27:172:28 | p1 | deallocation.rs:176:15:176:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:172:27:172:28 | p1 | invalid |
16-
| deallocation.rs:210:18:210:20 | ptr | deallocation.rs:204:27:204:29 | ptr | deallocation.rs:210:18:210:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:204:27:204:29 | ptr | invalid |
3+
| deallocation.rs:32:16:32:17 | m1 | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:32:16:32:17 | m1 | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
4+
| deallocation.rs:33:16:33:17 | m1 | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:33:16:33:17 | m1 | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
5+
| deallocation.rs:37:14:37:33 | ...::read::<...> | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:37:14:37:33 | ...::read::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
6+
| deallocation.rs:44:6:44:7 | m1 | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:44:6:44:7 | m1 | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
7+
| deallocation.rs:49:5:49:25 | ...::write::<...> | deallocation.rs:20:23:20:24 | m1 | deallocation.rs:49:5:49:25 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:20:23:20:24 | m1 | invalid |
8+
| deallocation.rs:76:16:76:17 | m2 | deallocation.rs:70:23:70:24 | m2 | deallocation.rs:76:16:76:17 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:70:23:70:24 | m2 | invalid |
9+
| deallocation.rs:81:16:81:17 | m2 | deallocation.rs:70:23:70:24 | m2 | deallocation.rs:81:16:81:17 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:70:23:70:24 | m2 | invalid |
10+
| deallocation.rs:86:7:86:8 | m2 | deallocation.rs:70:23:70:24 | m2 | deallocation.rs:86:7:86:8 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:70:23:70:24 | m2 | invalid |
11+
| deallocation.rs:90:7:90:8 | m2 | deallocation.rs:70:23:70:24 | m2 | deallocation.rs:90:7:90:8 | m2 | This operation dereferences a pointer that may be $@. | deallocation.rs:70:23:70:24 | m2 | invalid |
12+
| deallocation.rs:95:5:95:31 | ...::write::<...> | deallocation.rs:70:23:70:24 | m2 | deallocation.rs:95:5:95:31 | ...::write::<...> | This operation dereferences a pointer that may be $@. | deallocation.rs:70:23:70:24 | m2 | invalid |
13+
| deallocation.rs:115:13:115:18 | my_ptr | deallocation.rs:112:14:112:19 | my_ptr | deallocation.rs:115:13:115:18 | my_ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:112:14:112:19 | my_ptr | invalid |
14+
| deallocation.rs:130:14:130:15 | p1 | deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:130:14:130:15 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:123:23:123:40 | ...::dangling | invalid |
15+
| deallocation.rs:131:14:131:15 | p2 | deallocation.rs:124:21:124:42 | ...::dangling_mut | deallocation.rs:131:14:131:15 | p2 | This operation dereferences a pointer that may be $@. | deallocation.rs:124:21:124:42 | ...::dangling_mut | invalid |
16+
| deallocation.rs:132:14:132:15 | p3 | deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:132:14:132:15 | p3 | This operation dereferences a pointer that may be $@. | deallocation.rs:125:23:125:36 | ...::null | invalid |
17+
| deallocation.rs:180:15:180:16 | p1 | deallocation.rs:176:27:176:28 | p1 | deallocation.rs:180:15:180:16 | p1 | This operation dereferences a pointer that may be $@. | deallocation.rs:176:27:176:28 | p1 | invalid |
18+
| deallocation.rs:214:18:214:20 | ptr | deallocation.rs:208:27:208:29 | ptr | deallocation.rs:214:18:214:20 | ptr | This operation dereferences a pointer that may be $@. | deallocation.rs:208:27:208:29 | ptr | invalid |
1719
edges
1820
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:26:15:26:16 | m1 | provenance | |
19-
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:33:35:33:36 | m1 | provenance | |
20-
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:40:6:40:7 | m1 | provenance | |
21-
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:45:27:45:28 | m1 | provenance | |
22-
| deallocation.rs:33:35:33:36 | m1 | deallocation.rs:33:14:33:33 | ...::read::<...> | provenance | MaD:1 Sink:MaD:1 |
23-
| deallocation.rs:45:27:45:28 | m1 | deallocation.rs:45:5:45:25 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
24-
| deallocation.rs:66:23:66:24 | m2 | deallocation.rs:72:16:72:17 | m2 | provenance | |
25-
| deallocation.rs:66:23:66:24 | m2 | deallocation.rs:77:16:77:17 | m2 | provenance | |
26-
| deallocation.rs:66:23:66:24 | m2 | deallocation.rs:82:7:82:8 | m2 | provenance | |
27-
| deallocation.rs:66:23:66:24 | m2 | deallocation.rs:86:7:86:8 | m2 | provenance | |
28-
| deallocation.rs:66:23:66:24 | m2 | deallocation.rs:91:33:91:34 | m2 | provenance | |
29-
| deallocation.rs:91:33:91:34 | m2 | deallocation.rs:91:5:91:31 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
30-
| deallocation.rs:108:14:108:19 | my_ptr | deallocation.rs:111:13:111:18 | my_ptr | provenance | |
31-
| deallocation.rs:119:6:119:7 | p1 | deallocation.rs:126:14:126:15 | p1 | provenance | |
32-
| deallocation.rs:119:23:119:40 | ...::dangling | deallocation.rs:119:23:119:42 | ...::dangling(...) | provenance | Src:MaD:3 MaD:3 |
33-
| deallocation.rs:119:23:119:42 | ...::dangling(...) | deallocation.rs:119:6:119:7 | p1 | provenance | |
34-
| deallocation.rs:120:6:120:7 | p2 | deallocation.rs:127:14:127:15 | p2 | provenance | |
35-
| deallocation.rs:120:21:120:42 | ...::dangling_mut | deallocation.rs:120:21:120:44 | ...::dangling_mut(...) | provenance | Src:MaD:4 MaD:4 |
36-
| deallocation.rs:120:21:120:44 | ...::dangling_mut(...) | deallocation.rs:120:6:120:7 | p2 | provenance | |
37-
| deallocation.rs:121:6:121:7 | p3 | deallocation.rs:128:14:128:15 | p3 | provenance | |
38-
| deallocation.rs:121:23:121:36 | ...::null | deallocation.rs:121:23:121:38 | ...::null(...) | provenance | Src:MaD:5 MaD:5 |
39-
| deallocation.rs:121:23:121:38 | ...::null(...) | deallocation.rs:121:6:121:7 | p3 | provenance | |
40-
| deallocation.rs:172:27:172:28 | p1 | deallocation.rs:176:15:176:16 | p1 | provenance | |
41-
| deallocation.rs:204:27:204:29 | ptr | deallocation.rs:210:18:210:20 | ptr | provenance | |
21+
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:32:16:32:17 | m1 | provenance | |
22+
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:33:16:33:17 | m1 | provenance | |
23+
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:37:35:37:36 | m1 | provenance | |
24+
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:44:6:44:7 | m1 | provenance | |
25+
| deallocation.rs:20:23:20:24 | m1 | deallocation.rs:49:27:49:28 | m1 | provenance | |
26+
| deallocation.rs:37:35:37:36 | m1 | deallocation.rs:37:14:37:33 | ...::read::<...> | provenance | MaD:1 Sink:MaD:1 |
27+
| deallocation.rs:49:27:49:28 | m1 | deallocation.rs:49:5:49:25 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
28+
| deallocation.rs:70:23:70:24 | m2 | deallocation.rs:76:16:76:17 | m2 | provenance | |
29+
| deallocation.rs:70:23:70:24 | m2 | deallocation.rs:81:16:81:17 | m2 | provenance | |
30+
| deallocation.rs:70:23:70:24 | m2 | deallocation.rs:86:7:86:8 | m2 | provenance | |
31+
| deallocation.rs:70:23:70:24 | m2 | deallocation.rs:90:7:90:8 | m2 | provenance | |
32+
| deallocation.rs:70:23:70:24 | m2 | deallocation.rs:95:33:95:34 | m2 | provenance | |
33+
| deallocation.rs:95:33:95:34 | m2 | deallocation.rs:95:5:95:31 | ...::write::<...> | provenance | MaD:2 Sink:MaD:2 |
34+
| deallocation.rs:112:14:112:19 | my_ptr | deallocation.rs:115:13:115:18 | my_ptr | provenance | |
35+
| deallocation.rs:123:6:123:7 | p1 | deallocation.rs:130:14:130:15 | p1 | provenance | |
36+
| deallocation.rs:123:23:123:40 | ...::dangling | deallocation.rs:123:23:123:42 | ...::dangling(...) | provenance | Src:MaD:3 MaD:3 |
37+
| deallocation.rs:123:23:123:42 | ...::dangling(...) | deallocation.rs:123:6:123:7 | p1 | provenance | |
38+
| deallocation.rs:124:6:124:7 | p2 | deallocation.rs:131:14:131:15 | p2 | provenance | |
39+
| deallocation.rs:124:21:124:42 | ...::dangling_mut | deallocation.rs:124:21:124:44 | ...::dangling_mut(...) | provenance | Src:MaD:4 MaD:4 |
40+
| deallocation.rs:124:21:124:44 | ...::dangling_mut(...) | deallocation.rs:124:6:124:7 | p2 | provenance | |
41+
| deallocation.rs:125:6:125:7 | p3 | deallocation.rs:132:14:132:15 | p3 | provenance | |
42+
| deallocation.rs:125:23:125:36 | ...::null | deallocation.rs:125:23:125:38 | ...::null(...) | provenance | Src:MaD:5 MaD:5 |
43+
| deallocation.rs:125:23:125:38 | ...::null(...) | deallocation.rs:125:6:125:7 | p3 | provenance | |
44+
| deallocation.rs:176:27:176:28 | p1 | deallocation.rs:180:15:180:16 | p1 | provenance | |
45+
| deallocation.rs:208:27:208:29 | ptr | deallocation.rs:214:18:214:20 | ptr | provenance | |
4246
models
4347
| 1 | Sink: lang:core; crate::ptr::read; pointer-access; Argument[0] |
4448
| 2 | Sink: lang:core; crate::ptr::write; pointer-access; Argument[0] |
@@ -48,34 +52,36 @@ models
4852
nodes
4953
| deallocation.rs:20:23:20:24 | m1 | semmle.label | m1 |
5054
| deallocation.rs:26:15:26:16 | m1 | semmle.label | m1 |
51-
| deallocation.rs:33:14:33:33 | ...::read::<...> | semmle.label | ...::read::<...> |
52-
| deallocation.rs:33:35:33:36 | m1 | semmle.label | m1 |
53-
| deallocation.rs:40:6:40:7 | m1 | semmle.label | m1 |
54-
| deallocation.rs:45:5:45:25 | ...::write::<...> | semmle.label | ...::write::<...> |
55-
| deallocation.rs:45:27:45:28 | m1 | semmle.label | m1 |
56-
| deallocation.rs:66:23:66:24 | m2 | semmle.label | m2 |
57-
| deallocation.rs:72:16:72:17 | m2 | semmle.label | m2 |
58-
| deallocation.rs:77:16:77:17 | m2 | semmle.label | m2 |
59-
| deallocation.rs:82:7:82:8 | m2 | semmle.label | m2 |
55+
| deallocation.rs:32:16:32:17 | m1 | semmle.label | m1 |
56+
| deallocation.rs:33:16:33:17 | m1 | semmle.label | m1 |
57+
| deallocation.rs:37:14:37:33 | ...::read::<...> | semmle.label | ...::read::<...> |
58+
| deallocation.rs:37:35:37:36 | m1 | semmle.label | m1 |
59+
| deallocation.rs:44:6:44:7 | m1 | semmle.label | m1 |
60+
| deallocation.rs:49:5:49:25 | ...::write::<...> | semmle.label | ...::write::<...> |
61+
| deallocation.rs:49:27:49:28 | m1 | semmle.label | m1 |
62+
| deallocation.rs:70:23:70:24 | m2 | semmle.label | m2 |
63+
| deallocation.rs:76:16:76:17 | m2 | semmle.label | m2 |
64+
| deallocation.rs:81:16:81:17 | m2 | semmle.label | m2 |
6065
| deallocation.rs:86:7:86:8 | m2 | semmle.label | m2 |
61-
| deallocation.rs:91:5:91:31 | ...::write::<...> | semmle.label | ...::write::<...> |
62-
| deallocation.rs:91:33:91:34 | m2 | semmle.label | m2 |
63-
| deallocation.rs:108:14:108:19 | my_ptr | semmle.label | my_ptr |
64-
| deallocation.rs:111:13:111:18 | my_ptr | semmle.label | my_ptr |
65-
| deallocation.rs:119:6:119:7 | p1 | semmle.label | p1 |
66-
| deallocation.rs:119:23:119:40 | ...::dangling | semmle.label | ...::dangling |
67-
| deallocation.rs:119:23:119:42 | ...::dangling(...) | semmle.label | ...::dangling(...) |
68-
| deallocation.rs:120:6:120:7 | p2 | semmle.label | p2 |
69-
| deallocation.rs:120:21:120:42 | ...::dangling_mut | semmle.label | ...::dangling_mut |
70-
| deallocation.rs:120:21:120:44 | ...::dangling_mut(...) | semmle.label | ...::dangling_mut(...) |
71-
| deallocation.rs:121:6:121:7 | p3 | semmle.label | p3 |
72-
| deallocation.rs:121:23:121:36 | ...::null | semmle.label | ...::null |
73-
| deallocation.rs:121:23:121:38 | ...::null(...) | semmle.label | ...::null(...) |
74-
| deallocation.rs:126:14:126:15 | p1 | semmle.label | p1 |
75-
| deallocation.rs:127:14:127:15 | p2 | semmle.label | p2 |
76-
| deallocation.rs:128:14:128:15 | p3 | semmle.label | p3 |
77-
| deallocation.rs:172:27:172:28 | p1 | semmle.label | p1 |
78-
| deallocation.rs:176:15:176:16 | p1 | semmle.label | p1 |
79-
| deallocation.rs:204:27:204:29 | ptr | semmle.label | ptr |
80-
| deallocation.rs:210:18:210:20 | ptr | semmle.label | ptr |
66+
| deallocation.rs:90:7:90:8 | m2 | semmle.label | m2 |
67+
| deallocation.rs:95:5:95:31 | ...::write::<...> | semmle.label | ...::write::<...> |
68+
| deallocation.rs:95:33:95:34 | m2 | semmle.label | m2 |
69+
| deallocation.rs:112:14:112:19 | my_ptr | semmle.label | my_ptr |
70+
| deallocation.rs:115:13:115:18 | my_ptr | semmle.label | my_ptr |
71+
| deallocation.rs:123:6:123:7 | p1 | semmle.label | p1 |
72+
| deallocation.rs:123:23:123:40 | ...::dangling | semmle.label | ...::dangling |
73+
| deallocation.rs:123:23:123:42 | ...::dangling(...) | semmle.label | ...::dangling(...) |
74+
| deallocation.rs:124:6:124:7 | p2 | semmle.label | p2 |
75+
| deallocation.rs:124:21:124:42 | ...::dangling_mut | semmle.label | ...::dangling_mut |
76+
| deallocation.rs:124:21:124:44 | ...::dangling_mut(...) | semmle.label | ...::dangling_mut(...) |
77+
| deallocation.rs:125:6:125:7 | p3 | semmle.label | p3 |
78+
| deallocation.rs:125:23:125:36 | ...::null | semmle.label | ...::null |
79+
| deallocation.rs:125:23:125:38 | ...::null(...) | semmle.label | ...::null(...) |
80+
| deallocation.rs:130:14:130:15 | p1 | semmle.label | p1 |
81+
| deallocation.rs:131:14:131:15 | p2 | semmle.label | p2 |
82+
| deallocation.rs:132:14:132:15 | p3 | semmle.label | p3 |
83+
| deallocation.rs:176:27:176:28 | p1 | semmle.label | p1 |
84+
| deallocation.rs:180:15:180:16 | p1 | semmle.label | p1 |
85+
| deallocation.rs:208:27:208:29 | ptr | semmle.label | ptr |
86+
| deallocation.rs:214:18:214:20 | ptr | semmle.label | ptr |
8187
subpaths

‎rust/ql/test/query-tests/security/CWE-825/deallocation.rs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ pub fn test_alloc(mode: i32) {
2727
let v6 = *m2; // $ MISSING: Alert
2828
println!(" v5 = {v5} (!)"); // corrupt in practice
2929
println!(" v6 = {v6} (!)"); // corrupt in practice
30+
31+
// test repeat reads (we don't want lots of very similar results for the same dealloc)
32+
let v5b = *m1; // $ Alert[rust/access-invalid-pointer]=dealloc
33+
let v5c = *m1; // $ Alert[rust/access-invalid-pointer]=dealloc
3034
},
3135
100 => {
3236
// more reads

0 commit comments

Comments
 (0)