query.ql

/**
 * @name DTrace Out-of-bounds Read
 * @description DTrace uses user-controllable value as list index.
 * @kind problem
 * @problem.severity warning
 * @id apple-xnu/cpp/dtrace-unsafe-index-cve-2023-28200
 */

import cpp

from Variable arg, ArrayExpr ae
where
  exists(LTExpr le |
    le.getLeftOperand() = arg.getAnAccess() and
    le.getParent() instanceof IfStmt and
    le.getLeftOperand().getExplicitlyConverted().getUnderlyingType().(IntegralType).isSigned()
  ) and
  not exists(RelationalOperation ro |
    ro.getLeftOperand() = arg.getAnAccess() and
    ro.getParent() instanceof ForStmt
  ) and
  not exists(RelationalOperation ro |
    ro.getLeftOperand() = arg.getAnAccess() and
    ro.getRightOperand().getValue() = "0"
  ) and
  ae.getArrayOffset() = arg.getAnAccess() and
  ae.getFile().getAbsolutePath().matches("%/xnu-build/xnu/%") and
  not ae.getFile().getAbsolutePath().matches("%/xnu-build/xnu/SETUP/%")
select ae.getArrayOffset(), ae.getEnclosingFunction()