codeql/cpp/ql/test/query-tests/Security/CWE/CWE-704/WcharCharConversion.cpp at 990b7f0b7034ac5cc08bdb0e19d45adc5658d946 · jketema/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
#define NULL 0
#define CONST               const
typedef wchar_t WCHAR;    // wc,   16-bit UNICODE character
typedef char CHAR;

typedef WCHAR *LPWSTR;
typedef CONST WCHAR *LPCWSTR;

typedef CHAR *LPSTR;
typedef CONST CHAR *LPCSTR;

void fconstWChar(LPCWSTR p) {}
void fWChar(LPWSTR p) {}

void Test()
{
	char *lpChar = NULL;
	wchar_t *lpWchar = NULL;
	LPCSTR lpcstr = "b";

	lpWchar = (LPWSTR)"a"; // $ Alert
	lpWchar = (LPWSTR)lpcstr; // $ Alert

	lpWchar = (wchar_t*)lpChar;	// $ Alert

	fconstWChar((LPCWSTR)lpChar);	// $ Alert
	fWChar((LPWSTR)lpChar);			// $ Alert

	lpChar = (LPSTR)"a"; // Valid
	lpWchar = (LPWSTR)L"a"; // Valid

	fconstWChar((LPCWSTR)lpWchar);	// Valid
	fWChar(lpWchar);				// Valid
}

void NewBufferFalsePositiveTest()
{
	wchar_t *lpWchar = NULL;

	lpWchar = (LPWSTR)new char[56]; // Possible False Positive
}

typedef unsigned char BYTE;
typedef BYTE* PBYTE;

void NonStringFalsePositiveTest1(PBYTE buffer)
{
	wchar_t *lpWchar = NULL;
	lpWchar = (LPWSTR)buffer; // Possible False Positive
}

void NonStringFalsePositiveTest2(unsigned char* buffer)
{
	wchar_t *lpWchar = NULL;
	lpWchar = (LPWSTR)buffer; // Possible False Positive
}

typedef unsigned char BYTE;
using FOO = BYTE*;

void NonStringFalsePositiveTest3(FOO buffer)
{
	wchar_t *lpWchar = NULL;
	lpWchar = (LPWSTR)buffer; // GOOD
}

#define UNICODE 0x8

// assume EMPTY_MACRO is tied to if UNICODE is enabled
#ifdef EMPTY_MACRO
typedef WCHAR* LPTSTR;
#else
typedef char* LPTSTR;
#endif

void CheckedConversionFalsePositiveTest3(unsigned short flags, LPTSTR buffer)
{
	wchar_t *lpWchar = NULL;
	if(flags & UNICODE)
		lpWchar = (LPWSTR)buffer; // GOOD
	else
		lpWchar = (LPWSTR)buffer; // $ Alert

	if((flags & UNICODE) == 0x8)
		lpWchar = (LPWSTR)buffer; // GOOD
	else
		lpWchar = (LPWSTR)buffer; // $ Alert

	if((flags & UNICODE) != 0x8)
		lpWchar = (LPWSTR)buffer; // $ Alert
	else
		lpWchar = (LPWSTR)buffer; // GOOD

	// Bad operator precedence
	if(flags & UNICODE == 0x8)
		lpWchar = (LPWSTR)buffer; // $ Alert
	else
		lpWchar = (LPWSTR)buffer; // $ Alert

	if((flags & UNICODE) != 0)
		lpWchar = (LPWSTR)buffer; // GOOD
	else
		lpWchar = (LPWSTR)buffer; // $ Alert

	if((flags & UNICODE) == 0)
		lpWchar = (LPWSTR)buffer; // $ Alert
	else
		lpWchar = (LPWSTR)buffer; // GOOD

	lpWchar = (LPWSTR)buffer; // $ Alert
}

typedef unsigned long long size_t;

size_t wcslen(const wchar_t *str);
size_t strlen(const char* str);

template<typename C>
size_t str_len(const C *str) {
	if (sizeof(C) != 1) {
		return wcslen((const wchar_t *)str); // GOOD -- unreachable code
	}

	return strlen((const char *)str);
}

template<typename C>
size_t wrong_str_len(const C *str) {
	if (sizeof(C) == 1) {
		return wcslen((const wchar_t *)str); // $ Alert
	}

	return strlen((const char *)str);
}

void test_str_len(const wchar_t *wstr, const char *str) {
	size_t len =
	  str_len(wstr) +
	  str_len(str) +
	  wrong_str_len(wstr) +
	  wrong_str_len(str);
}