From 64fa6c8bbd1f71e1471ab93dc988f299cd8c5be0 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Thu, 12 Oct 2023 13:58:36 +0100 Subject: [PATCH] C++: Remove the hacky flow state since this is no longer needed after #13717. --- .../CWE/CWE-119/OverrunWriteProductFlow.ql | 28 ++++--------------- 1 file changed, 6 insertions(+), 22 deletions(-) diff --git a/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql b/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql index 471aa8b42b8..1872234ead2 100644 --- a/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql +++ b/cpp/ql/src/Security/CWE/CWE-119/OverrunWriteProductFlow.ql @@ -82,36 +82,20 @@ module ValidState { * library will perform, and visit all the places where the size argument is modified. * 2. Once that dataflow traversal is done, we accumulate the offsets added at each places * where the offset is modified (see `validStateImpl`). - * - * Because we want to guarantee that each place where we modify the offset has a `PathNode` - * we "flip" a boolean flow state in each `isAdditionalFlowStep`. This ensures that the node - * has a corresponding `PathNode`. */ - private module ValidStateConfig implements DataFlow::StateConfigSig { - class FlowState = boolean; + private module ValidStateConfig implements DataFlow::ConfigSig { + predicate isSource(DataFlow::Node source) { hasSize(_, source, _) } - predicate isSource(DataFlow::Node source, FlowState state) { - hasSize(_, source, _) and - state = false - } + predicate isSink(DataFlow::Node sink) { isSinkPairImpl(_, _, sink, _, _) } - predicate isSink(DataFlow::Node sink, FlowState state) { - isSinkPairImpl(_, _, sink, _, _) and - state = [false, true] - } - - predicate isAdditionalFlowStep( - DataFlow::Node node1, FlowState state1, DataFlow::Node node2, FlowState state2 - ) { - isAdditionalFlowStep2(node1, node2, _) and - state1 = [false, true] and - state2 = state1.booleanNot() + predicate isAdditionalFlowStep(DataFlow::Node node1, DataFlow::Node node2) { + isAdditionalFlowStep2(node1, node2, _) } predicate includeHiddenNodes() { any() } } - private import DataFlow::GlobalWithState + private import DataFlow::Global private predicate inLoop(PathNode n) { n.getASuccessor+() = n }