halahajyahia/cve-2022-2869-detectorCodeQL detector for CVE-2022-2869 root cause (CWE-191 unsigned underflow) using control-flow/range analysis to identify vulnerable patterns without hard-coding specific functions.
This project implements a general CodeQL detector for the root weakness behind CVE-2022-2869: an unsigned subtraction that may underflow because the program has not established a sufficient lower-bound/order guard before the arithmetic.
The detector deliberately reports the root cause (CWE-191) rather than hard-coding tiffcrop.c, function names, or variable names. It uses CodeQL's standard Overflow library, whose guard reasoning is based on control flow/range analysis. It does not use source-code line-number ordering as a substitute for control-flow dominance.
UnsignedUnderflow.ql — primary detector to submit.report.md — vulnerability and query explanation.test/mini_tiffcrop_like.c — CVE-like unsafe cases plus safe controls.test/mini_tiffcrop_variant.c — a structurally different variation plus safe control.test/EXPECTED_RESULTS.md — intended positive/negative behavior.original/ORIGINAL_VALIDATION.md — what must be demonstrated on vulnerable LibTIFF.From this directory:
codeql pack install
Example on Linux/WSL:
codeql database create db-tests \
--language=cpp \
--command="gcc -std=c11 -O0 -g test/mini_tiffcrop_like.c -o /tmp/test1 && gcc -std=c11 -O0 -g test/mini_tiffcrop_variant.c -o /tmp/test2"
Run the query:
codeql query run UnsignedUnderflow.ql --database=db-tests
The CodeQL query is static analysis. ASan is optional evidence showing the consequence of the custom variations.
gcc -std=c11 -O0 -g -fsanitize=address test/mini_tiffcrop_like.c -o mini1
./mini1 # safe
./mini1 unsafe-x2 # expected memory error
gcc -std=c11 -O0 -g -fsanitize=address test/mini_tiffcrop_variant.c -o mini2
./mini2 # safe
./mini2 unsafe # expected memory error
Build a CodeQL database from a vulnerable LibTIFF revision (for example 4.3.0), then run exactly the same UnsignedUnderflow.ql query against that database. Capture the result in tools/tiffcrop.c, especially computeInputPixelOffsets.
The detector must not be changed to mention tiffcrop, computeInputPixelOffsets, x2, or crop_width; otherwise it would be overfitted to one CVE instance and would fail the assignment's variation requirement.