官方题解 | DataCon2023漏洞分析赛道之二进制漏洞模式归纳与自动化挖掘

match (n:identifier) where n.callee="strcat" and n.index=1 with [n] as taintPropagationPath RETURN taintPropagationPath

void * memmove(void *dst, const void *src, size_t len);

memmove(dest, src, sizeof(dest));

dest = malloc(size);memmove(dst, src, size);

match (n:identifier{callee:"memmove",index:0}), (m:identifier{callee:"memmove",index:2})where n.function=m.function and m.line=n.line and not (m)-[:dfg]-(n) WITH [m] AS taintPropagationPath RETURN taintPropagationPath

match (n:identifier) where n.is_source=1 with collect(id(n)) as sourceSet match (m:identifier{index:0}) where m.is_sink=1 with sourceSet,collect(id(m)) as sinkSet CALL VQL.taintPropagation(sourceSet, sinkSet,1) YIELD taintPropagationPath RETURN taintPropagationPath ORDER BY size(taintPropagationPath)

MATCH (n:function)WHERE n.name =~ ".*decode.*|.*hex.*"RETURN n.nameLIMIT 1000

cc = recvfrom(ufd.fd, &buf, sizeof(buf), 0, (struct sockaddr *)&sl, &salen);  if (cc < 0) {   switch (errno)   {   case EINTR:   continue;    case EAGAIN:   return;  default:     cc = 0;      }    }  snprintf(log_buf, sizeof(log_buf), "recvfrom recved : %s", buf);  printf(log_buf);

MATCH (n:identifier) WHERE n.callee = "recvfrom" AND n.index=1 WITH collect(id(n)) as sourceSetMATCH (n:identifier) WHERE n.callee = "printf" AND n.index=0 WITH sourceSet,collect(id(n)) as sinkSet call VQL.taintPropagation(sourceSet,sinkSet,3)YIELD taintPropagationPath RETURN taintPropagationPath

match (n:identifier) where n.callee="strcat" and n.index=1  return n

match (n:identifier) where n.callee="strcat" and n.index=1  return 

match (n:identifier{callee:"memmove",index:0}), (m:identifier{callee:"memmove",index:2})where n.function=m.function and m.line=n.line and not (m)-[:dfg]-(n) return m.function,m.file

switch (caphdr.code) {case CAPABILITY_CODE_MP: {*mp_capability = 1;

/* Ignore capability when override-capability is set. */if (!CHECK_FLAG(peer->flags,PEER_FLAG_OVERRIDE_CAPABILITY)) {/* Set negotiated value. */ret = bgp_capability_mp(peer, &caphdr);

/* Unsupported Capability. */if (ret < 0) {/* Store return data. */char tmp_buf[0x30];memmove(tmp_buf, sp, caphdr.length + 2);strcpy(*error, tmp_buf);*error += caphdr.length + 2;}ret = 0; /* Don't return error for this */}  } break;

match (n:identifier{callee:"memmove",index:0}), (m:identifier{callee:"memmove",index:2})where n.function=m.function and m.line=n.line and not (m)-[:dfg]-(n) return m.function,m.file

if ((ok = (p_pnt < p_end)))orfp.p.prefixlen = *p_pnt++;/* afi checked already */orfp.p.family = afi2family(afi);/* 0 if not ok */psize = PSIZE(orfp.p.prefixlen);
if (psize > 0)memmove(&orfp.p.u.prefix, p_pnt,    psize);

match (n:identifier{callee:"memmove",index:0}), (m:identifier{callee:"memmove",index:2})where n.function=m.function and m.line=n.line and not (m)-[:dfg]-(n) return m.function,m.file

newline = strchr(buf, 'n');if (!newline)break;
line_len = newline + 1 - buf;snprintf(log_buf, line_len, "%s", newline); printf("%s", log_buf);

MATCH (n:identifier) WHERE n.callee = "ustream_get_read_buf" AND n.index=-1 WITH collect(id(n)) as sourceSet MATCH (n:identifier) WHERE n.callee = "snprintf" AND n.index=1 WITH sourceSet,collect(id(n)) as sinkSet CALL VQL.taintPropagation(sourceSet,sinkSet,3)YIELD taintPropagationPath RETURN taintPropagationPath

static ssize_t session_get_pdu(struct ibuf_read *r, char **b){struct ldp_hdr l;size_t av, dlen, left;
av = r->wpos;if (av < sizeof(l))return (0);
memcpy(&l, r->buf, sizeof(l));dlen = ntohs(l.length) + LDP_HDR_DEAD_LEN;
if ((*b = malloc(dlen)) == NULL)return (-1);
memcpy(*b, r->buf, dlen);
left = av - dlen;memmove(r->buf, r->buf + dlen, left);r->wpos = left;
return (dlen);}

match (n:identifier{callee:"memmove",index:0}), (m:identifier{callee:"memmove",index:2})where n.function=m.function and m.line=n.line and not (m)-[:dfg]-(n) return m.function,m.file

{   log_warn("lldp",   "unable to allocate memory for id tlv "       "received on %s",  hardware->h_ifname);  goto malformed;  }     memmove(b, pos, tlv_size - 1);

match (n:identifier{callee:"memmove",index:0}), (m:identifier{callee:"memmove",index:2})where n.function=m.function and m.line=n.line and not (m)-[:dfg]-(n) return m.function,m.file

{  log_warn("lldp",   "unable to allocate memory for string tlv " "received on %s",  hardware->h_ifname);  goto malformed;  }    memmove(b, pos, tlv_size - 1);

tmp_size = outer.length << 3;if (inner.length) {  peer->notify.length = inner.length;  peer->notify.data = malloc(tmp_size);  memcpy(peer->notify.data, inner.raw_data, inner.length);  }

MATCH (n:identifier) WHERE n.callee = "stream_getw" AND n.index=-1 WITH collect(id(n)) as sourceSet MATCH (n:identifier) WHERE n.callee = "malloc" AND n.index=0 WITH sourceSet,collect(id(n)) as sinkSet call VQL.taintPropagation(sourceSet,sinkSet,2)YIELD taintPropagationPath RETURN taintPropagationPath

/* For further diagnostic record returned Data. */  if (inner.length) {    peer->notify.length = inner.length;    peer->notify.data = malloc(tmp_size);    memcpy(peer->notify.data, inner.raw_data, inner.length);  }

/* For debug */{int i;int first = 0;char c[4];

if (inner.length) {inner.data = malloc(tmp_size);for (i = 0; i < inner.length; i++)if (first) {snprintf(c, sizeof(c), " %02x",  stream_getc(peer->curr));

/* Validate header fields. */  plen = ntohl(bcm.bcm_length); bcb->bcb_buf = malloc(sizeof(bcm) + bcb->bcb_left + 1);  if (bcb->bcb_buf == NULL) {  zlog_warn("%s: not enough memory for message size: %zu",    __func__, bcb->bcb_left);  control_free(bcs);  return;  }

call VQL.getArgument("malloc",0) yield node with collect(id(node)) as sinksetcall VQL.getArgument("read",1) yield node with collect(id(node)) as sourceset,sinksetcall VQL.taintPropagation(sourceset,sinkset,3) yield taintPropagationPath return taintPropagationPath

char tmp_buf[0x80];if (auth && !strncasecmp(auth, "Basic ", 6)){auth += 6;

uh_b64decode(tmp_buf, auth, strlen(auth));pass = strchr(tmp_buf, ':');if (pass){user = tmp_buf;*pass++ = 0;}  }

MATCH (n:function)WHERE n.name =~ ".*decode.*|.*hex.*"RETURN n.nameLIMIT 1000

/* no query string, decode all of url */  else if (uh_urldecode(&uh_buff[docroot_len],              url, strlen(url)) < 0)    return NULL;

/* urldecode component w/o query */  if (pathptr > url)  {  if (uh_urldecode(&uh_buff[docroot_len], url, pathptr - url) < 0)  return NULL;    }

dhcpv6_for_each_option(start, end, otype, olen, odata){if (otype == DHCPV6_OPT_CLIENTID){clid_data = odata;clid_len = olen;
if (olen == 14 && odata[0] == 0 && odata[1] == 1)memcpy(mac, &odata[8], sizeof(mac));else if (olen == 10 && odata[0] == 0 && odata[1] == 3)memcpy(mac, &odata[4], sizeof(mac));
odhcpd_hexlify(duidbuf, odata, olen);    }

char v8[512]; // [esp+1Ch] [ebp-61Ch] BYREFchar v9[1024]; /strvis(v8, v9, 27);