Joern/community

@GAMERAvsGYAOS_twitter, I don't know of any easy way to find this bug for a variable declared on the stack. If buffer was allocated with malloc(sz), then this would've been much easier as you would've already seen in some examples.

This is what I could come up with for this snippet:

You could check for calls to strcpy, and basically, since the buffer is allocated on the stack, the size would be in the data type of the variable which you could get with:

joern> cpg.call.name("strcpy").argument.isIdentifier.evalType.p 
res6: List[String] = List("char [ 5 ]")

So you can see that it is a static buffer of size 5.

A more suitable example would be if we replace strcpy with strncpy, since strcpy is generally always vulnerable.

strncpy(buffer, argv[1], 8);

So to find this, we could do:

def f() = {
    val x = cpg.call.name("strncpy")
        .argument
        .order(1)
        .isIdentifier
        .evalType
        .l
        .head

    val y = cpg.call.name("strncpy")
        .argument
        .order(3)
        .isLiteral
        .l
        .head
        .code
        .toInt

    val pattern = "\\d+".r
    val sz = pattern.findFirstIn(x)

    val bufsize = sz match {
        case Some(n) => n.toInt
        case None => 0
    }

    if (bufsize >= y) {
        println("Not vulnerable")
    }
    else {
        println(s"Vulnerable")
    }
}

joern> f 
Vulnerable