Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Integer trunk #383

Closed
wants to merge 2 commits into from
Closed

Integer trunk #383

wants to merge 2 commits into from

Conversation

bcaller
Copy link
Contributor

@bcaller bcaller commented Oct 3, 2023

Closes #382

Now you can do `char oops = 3458079` if you must
short short_var;

// ruleid: integer-truncation
short_var = int_var;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/0xdea/semgrep-rules/blob/main/c/integer-truncation.yaml


Cc @thypon @bcaller

{
short short_var;
// ruleid: integer-truncation
int int_var = long_var + 1;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/0xdea/semgrep-rules/blob/main/c/integer-truncation.yaml


Cc @thypon @bcaller

int int_var = long_var + 1;

// ruleid: integer-truncation
short_var = long_var;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/0xdea/semgrep-rules/blob/main/c/integer-truncation.yaml


Cc @thypon @bcaller

{
int a = 42;
return a;
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/0xdea/semgrep-rules/blob/main/c/integer-truncation.yaml


Cc @thypon @bcaller

int assign_int(int int_var)
{
// ruleid: integer-truncation
char char_var = int_var;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/0xdea/semgrep-rules/blob/main/c/integer-truncation.yaml


Cc @thypon @bcaller

short short_var;

// ruleid: integer-truncation
short_var = int_var;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/integer-truncation.yaml


Cc @thypon @bcaller

{
short short_var;
// ruleid: integer-truncation
int int_var = long_var + 1;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/integer-truncation.yaml


Cc @thypon @bcaller

int int_var = long_var + 1;

// ruleid: integer-truncation
short_var = long_var;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/integer-truncation.yaml


Cc @thypon @bcaller

short shortPrimitive;
intPrimitive = (int)(~((int)0) ^ (1 << (sizeof(int)*8-1)));
// ruleid: integer-truncation
shortPrimitive = intPrimitive;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/integer-truncation.yaml


Cc @thypon @bcaller

{
int a = 42;
return a;
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/integer-truncation.yaml


Cc @thypon @bcaller

int assign_int(int int_var)
{
// ruleid: integer-truncation
char char_var = int_var;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/integer-truncation.yaml


Cc @thypon @bcaller

@brave brave deleted a comment from github-actions bot Oct 3, 2023
@brave brave deleted a comment from github-actions bot Oct 3, 2023
shortPrimitive = intPrimitive;
printf("Int MAXINT: %d\nShort MAXINT: %d\n", intPrimitive, shortPrimitive);
// ok: integer-truncation
char c = 0x0;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/0xdea/semgrep-rules/blob/main/c/integer-truncation.yaml


Cc @thypon @bcaller

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@thypon why is the blocklist not working?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that LARGE is not captured since it's in an inner pattern-either. The variable will most probably be nil in that metavariable scope

Copy link
Contributor Author

@bcaller bcaller Oct 3, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, the new rule works. I think this is the original version of the rule from audit.yaml with
Source: https://github.com/0xdea/semgrep-rules/blob/main/c/integer-truncation.yaml
rather than
Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/integer-truncation.yaml - it somehow didn't get removed by the blocklist

// ok: integer-truncation
char c = 0x0;
// ok: integer-truncation
char cc = 127;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reported by reviewdog 🐶
[semgrep] Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. The value cannot be trusted and the application will be in an undefined state.

Source: https://github.com/0xdea/semgrep-rules/blob/main/c/integer-truncation.yaml


Cc @thypon @bcaller

@brave brave deleted a comment from github-actions bot Oct 3, 2023
@bcaller bcaller marked this pull request as draft October 3, 2023 22:09
@thypon thypon closed this Aug 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

char foo = 0; is not a truncation
2 participants