UnterminatedVarargsCall.ql

/**
 * @name Unterminated variadic call
 * @description Calling a variadic function without a sentinel value
 * may result in a buffer overflow if the function expects
 * a specific value to terminate the argument list.
 * @kind problem
 * @problem.severity warning
 * @security-severity 8.8
 * @precision medium
 * @id cpp/unterminated-variadic-call
 * @tags reliability
 * security
 * external/cwe/cwe-121
 */

import cpp

/**
 * Gets a normalized textual representation of `e`'s value.
 * The result is the same as `Expr.getValue()`, except if there is a
 * trailing `".0"` then it is removed. This means that, for example,
 * the values of `-1` and `-1.0` would be considered the same.
 */
stringnormalisedExprValue(Expre){result=e.getValue().regexpReplaceAll("\\.0$","")}

/**
 * A variadic function which is not a formatting function.
 */
classVarargsFunctionextendsFunction{
VarargsFunction(){
this.isVarargs()and
notthisinstanceofFormattingFunction
}

ExprtrailingArgumentIn(FunctionCallfc){
fc=this.getACallToThisFunction()and
result=fc.getArgument(fc.getNumberOfArguments()-1)
}

stringtrailingArgValue(FunctionCallfc){
result=normalisedExprValue(this.trailingArgumentIn(fc))
}

privateinttrailingArgValueCount(stringvalue){
result=strictcount(FunctionCallfc|this.trailingArgValue(fc)=value)
}

stringnonTrailingVarArgValue(FunctionCallfc,intindex){
fc=this.getACallToThisFunction()and
index>=this.getNumberOfParameters()and
index<fc.getNumberOfArguments()-1and
result=normalisedExprValue(fc.getArgument(index))
}

privateinttotalCount(){
result=strictcount(FunctionCallfc|fc=this.getACallToThisFunction())
}

stringnormalTerminator(intcnt,inttotalCount){
// the terminator is 0 or -1
result=["0","-1"]and
// at least 80% of calls have the terminator
cnt=this.trailingArgValueCount(result)and
totalCount=this.totalCount()and
100*cnt/totalCount>=80and
// terminator value is not used in a non-terminating position
notthis.nonTrailingVarArgValue(_, _)=result
}

predicateisWhitelisted(){this.hasGlobalName(["open","fcntl","ptrace","mremap"])}
}

fromVarargsFunctionf,FunctionCallfc,stringterminator,intcnt,inttotalCount
where
terminator=f.normalTerminator(cnt,totalCount)and
fc=f.getACallToThisFunction()and
notnormalisedExprValue(f.trailingArgumentIn(fc))=terminatorand
notf.isWhitelisted()
selectfc,
"Calls to $@ should use the value "+terminator+" as a terminator ("+cnt+" of "+
totalCount+" calls do).",f,f.getQualifiedName()