diff --git a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll index 25b456e9282..1235969f19f 100644 --- a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll +++ b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll @@ -222,6 +222,12 @@ private module InterestingPointerAddInstruction { ) } + /** + * Holds if `n` is a size of an allocation whose result flows to the left operand + * of a pointer-arithmetic instruction. + * + * This predicate is used to reduce the set of tuples in `SizeBarrierConfig::isSource`. + */ predicate isInterestingSize(DataFlow::Node n) { exists(DataFlow::Node alloc | hasSize(alloc.asConvertedExpr(), n, _) and