C++: Fix upper bound detection in default taint flow

2026-03-05 23:26:51 +01:00 · 2022-11-24 14:38:36 +01:00
parent d9fab8afd9
commit 223eeb6921
8 changed files with 2 additions and 51 deletions
--- a/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
+++ b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
@@ -81,7 +81,7 @@ class TaintedAllocationSizeConfiguration extends TaintTracking::Configuration {
    )
    or
    exists(Variable checkedVar |
-      readsVariable(node.asInstruction(), checkedVar) and
+      node.asExpr().(VariableAccess).getTarget() = checkedVar and
      hasUpperBoundsCheck(checkedVar)
    )
    or