hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-02 12:15:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Only allow taint to a FieldAddressInstruction if it's a union type.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2021-03-04 16:29:44 +01:00
parent eb4f1e1ba0
commit 23876cb581
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll
View File

@@ -64,7 +64,7 @@ private predicate operandToInstructionTaintStep(Operand opFrom, Instruction inst
or
instrTo instanceof PointerArithmeticInstruction
or
instrTo instanceof FieldAddressInstruction
instrTo.(FieldAddressInstruction).getField().getDeclaringType() instanceof Union
or
// The `CopyInstruction` case is also present in non-taint data flow, but
// that uses `getDef` rather than `getAnyDef`. For taint, we want flow