import cpp import semmle.code.cpp.dataflow.new.DataFlow import semmle.code.cpp.controlflow.Guards /** * An access of a dynamic input array (of type `dyn_input_t`) */ class DynamicInputAccess extends ArrayExpr { DynamicInputAccess() { // copy your solution from Exercise 1 none() } } /** * A call to `DYN_INPUT_TYPE` */ class TypeValidationCall extends FunctionCall { TypeValidationCall() { // replace this none() } } /** * Relates a `call` to a `guard`, which uses the result of the call to validate * equality of the result of `call` against `other` to guard `block`. */ predicate typeValidationGuard( GuardCondition guard, TypeValidationCall call, Expr other, BasicBlock block ) { // replace this none() } from DynamicInputAccess access where not typeValidationGuard(_, _, _, access.getBasicBlock()) select access, "Access to dynamic input array without type validation."