codeql/cpp/ql/test/query-tests/Microsoft/Likely Bugs/Drivers/test.c at b2892b0b01652896cd7e9f5c6ca3146e4f4f7647 · microsoft/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
// semmle-extractor-options: --microsoft
typedef unsigned __int64 size_t;

size_t RtlCompareMemory(
	const void* Source1,
	const void* Source2,
	size_t Length
)
{
	return Length;
}


#define bool	_Bool
#define false	0
#define true	1

typedef unsigned char UCHAR;
typedef UCHAR BOOLEAN;           // winnt
#define FALSE   0
#define TRUE    1

int Test(const void* ptr)
{
	size_t t = RtlCompareMemory("test", ptr, 5); //OK
	bool x;
	BOOLEAN y;

	if (t > 0 && RtlCompareMemory("test", ptr, 5)) //bug
	{
		t++;
	}

	if (!RtlCompareMemory("test", ptr, 4)) //bug
	{
		t--;
	}

	if (RtlCompareMemory("test", ptr, 4)) //bug
	{
		t--;
	}

	if (6 == RtlCompareMemory("test", ptr, 4)) //OK
	{
		t++;
	}

	if (0 == RtlCompareMemory("test", ptr, 4)) // FALSE NEGATIVE: potentially a bug but results in too many false positives (lower precision, perhaps != 0 is a good case but == 0 isn't?)
	{
		t++;
	}

	if (6 == RtlCompareMemory("test", ptr, 4) + 1) //OK
	{
		t++;
	}

	if (0 == RtlCompareMemory("test", ptr, 4) + 1) // OK
	{
		t++;
	}

	switch (RtlCompareMemory("test", ptr, 4))
	{
	case 1:
		t--;
		break;
	default:
		t++;
	}

	/// _Bool

	x = RtlCompareMemory("test", ptr, 4); // bug

	if (false == RtlCompareMemory("test", ptr, 4)) // bug
	{
		t++;
	}

	// BOOLEAN

	y = RtlCompareMemory("test", ptr, 4); // bug

	if (TRUE == RtlCompareMemory("test", ptr, 4)) // bug
	{
		t++;
	}

	return (t == 5) && RtlCompareMemory("test", ptr, 5); //bug
}