DoNotPassInvalidDataToTheAsctimeFunction.ql

/**
 * @id c/cert/do-not-pass-invalid-data-to-the-asctime-function
 * @name MSC33-C: Do not pass invalid data to the asctime() function
 * @description The data passed to the asctime() function is invalid. This can lead to buffer
 *              overflow.
 * @kind problem
 * @precision very-high
 * @problem.severity error
 * @tags external/cert/id/msc33-c
 *       security
 *       correctness
 *       external/cert/severity/high
 *       external/cert/likelihood/likely
 *       external/cert/remediation-cost/low
 *       external/cert/priority/p27
 *       external/cert/level/l1
 *       external/cert/obligation/rule
 */

import cpp
import codingstandards.c.cert
import semmle.code.cpp.dataflow.new.DataFlow

/**
 * The argument of a call to `asctime`
 */
class AsctimeArg extends Expr {
  AsctimeArg() {
    this =
      any(FunctionCall f | f.getTarget().hasGlobalName(["asctime", "asctime_r"])).getArgument(0)
  }

  DataFlow::Node asSink() { this = result.asIndirectExpr() }
}

/**
 * Dataflow configuration for flow from a library function
 * to a call of function `asctime`
 */
module TmStructSafeConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node src) {
    src.asIndirectExpr()
        .(FunctionCall)
        .getTarget()
        .hasGlobalName(["localtime", "localtime_r", "localtime_s", "gmtime", "gmtime_r", "gmtime_s"])
  }

  predicate isSink(DataFlow::Node sink) { exists(AsctimeArg arg | arg.asSink() = sink) }
}

module TmStructSafeFlow = DataFlow::Global<TmStructSafeConfig>;

from AsctimeArg fc
where
  not isExcluded(fc, Contracts7Package::doNotPassInvalidDataToTheAsctimeFunctionQuery()) and
  not TmStructSafeFlow::flowTo(fc.asSink())
select fc,
  "The function `asctime` and `asctime_r` should be discouraged. Unsanitized input can overflow the output buffer."