C++: Fix upper bound detection in default taint flow

2026-05-02 04:05:14 +02:00 · 2022-11-24 14:38:36 +01:00
parent d9fab8afd9
commit 223eeb6921
8 changed files with 2 additions and 51 deletions
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -175,7 +175,7 @@ private module Cached {
  cached
  predicate nodeIsBarrier(DataFlow::Node node) {
    exists(Variable checkedVar |
-      readsVariable(node.asInstruction(), checkedVar) and
+      node.asExpr().(VariableAccess).getTarget() = checkedVar and
      hasUpperBoundsCheck(checkedVar)
    )
    or