hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: 'Step 1' does not make a lot of sense now that the files have been split.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-07-25 09:07:01 +02:00
parent acb1310e99
commit 359a9e5fe8
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll
View File

@@ -18,8 +18,9 @@
*
* Merely _constructing_ a pointer that's out-of-bounds is fine if the pointer is never dereferenced (in reality, the
* standard only guarentees that it's safe to move the pointer one element past the last element. But we ignore that
* here). So this step is about identifying which of those out-of-bounds pointers identified from step 1 that are
* actually being dereferenced. We do this using a regular dataflow configuration (see `InvalidPointerToDerefConfig`).
* here). So this step is about identifying which of those out-of-bounds pointers found by `pointerAddInstructionHasBounds`
* in `AllocationToInvalidPointer.qll` that are actually being dereferenced. We do this using a regular dataflow
* configuration (see `InvalidPointerToDerefConfig`).
*
* This dataflow traversal defines the set of sources as any dataflow node that is non-strictly lower-bounded by the
* pointer-arithmetic instruction identified by `AllocationToInvalidPointer.qll`. That is, the set of sources is any