hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 10:46:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Simplify the description of the source.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-07-25 09:13:27 +02:00
parent 359a9e5fe8
commit 55cfadb1f4
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll
View File

@@ -22,9 +22,10 @@
* in `AllocationToInvalidPointer.qll` that are actually being dereferenced. We do this using a regular dataflow
* configuration (see `InvalidPointerToDerefConfig`).
*
* This dataflow traversal defines the set of sources as any dataflow node that is non-strictly lower-bounded by the
* pointer-arithmetic instruction identified by `AllocationToInvalidPointer.qll`. That is, the set of sources is any
* dataflow node `source` such that `source.asInstruction() >= pai + delta1` for some `delta1 >= 0`.
* This dataflow traversal defines the set of sources as any dataflow node `n` such that there exists a pointer-arithmetic
* instruction `pai` found by `AllocationToInvalidPointer.qll` and `n.asInstruction() >= pai + deltaDerefSourceAndPai`.
* Here, `deltaDerefSourceAndPai` is the constant difference between the source we track for finding a dereference and the
* pointer-arithmetic instruction.
*
* The set of sinks is defined to be any address operand `addr` that is non-strictly upper-bounded by the sink. That is,
* any dataflow node `n` such that `addr <= sink.asInstruction() + delta2` for some `delta2`. We call the instruction that