Skip to content

Commit

Permalink
Fix mitigation search in over and underflows
Browse files Browse the repository at this point in the history
  • Loading branch information
konradweiss committed Nov 29, 2023
1 parent f5b1840 commit db42d6d
Showing 1 changed file with 13 additions and 4 deletions.
17 changes: 13 additions & 4 deletions cpg-solidity/src/main/resources/OverUnderflow
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,9 @@ and(
(
exists{
(b)-[d:DFG*#]->(:FieldDeclaration)
} or exists {
(b)-[d:DFG*#]->(bin:BinaryOperator)-[:DFG]->()-[:EOG]->(:Rollback)
where bin.operatorCode in ['<', '>', '<=', '>=', '==']
} or exists {
(b)-[d:DFG*#]->(bin:BinaryOperator)-[:LHS]->()-[:BASE|CALLEE|LHS|ARRAY_EXPRESSION*]->()<-[:DFG*#]-(:FieldDeclaration)
where bin.operatorCode in ['=', '|=', '^=', '&=', '<<=','>>=','+=', '-=', '*=', '/=', '%=']
Expand All @@ -21,13 +24,19 @@ and(
}or exists {
(b)<-[:VALUE]-(:SpecifiedExpression)
}
) and not exists {
bpath=(f)-[:EOG*]->(branch)-[:EOG*]->(l)
where branch in nodes(p) and not exists((l)-[:EOG]->())
) and not exists {// There is no mitigation
match bpath=(f)-[:EOG*]->(cond:BinaryOperator)-[:EOG]->(branch)-[:EOG*]->(l)
match (c1)<-[:LHS|RHS]-(cond)-[:LHS|RHS]->(c2)
where c1 <> c2 and branch in nodes(p) and not exists((l)-[:EOG]->())
and (not b in nodes(bpath) or 'Rollback' in labels(l))
and not exists {
(dfOrigin)-[:DFG*#]->(b) where not exists(()-[:DFG]->(dfOrigin)) and not exists ((dfOrigin)-[:DFG*]->(branch))
} and not exists{(b)-[:DFG*#]->(branch)}
} and (
not exists{(b)-[:DFG*#]->(branch)} or
// Both sides of the comparison need to contain a relevant dfg to avoid constants and overflows on one side
exists ((b)<-[:DFG*]-()-[:DFG*]->(c1))
and exists ((b)<-[:DFG*]-()-[:DFG*]->(c2))
)
}

)
Expand Down

0 comments on commit db42d6d

Please sign in to comment.