hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 06:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Do not flow taint through remainder expressions

Browse Source 
If the tainted operand is the first operand then it is being bounded above
by the remainder expression. If it is the second operand then
This commit is contained in:
Owen Mansel-Chan
2020-08-21 15:35:00 +01:00
parent aed3ef4cde
commit a669fa4aa1
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ql/src/semmle/go/security/AllocationSizeOverflowCustomizations.qll
View File

@@ -175,7 +175,7 @@ module AllocationSizeOverflow {
/**
* Holds if the value of `pred` can flow into `succ` in one step, either through a call to `len`
* or through an arithmetic operation.
* or through an arithmetic operation (other than remainder).
*/
predicate additionalStep(DataFlow::Node pred, DataFlow::Node succ) {
exists(DataFlow::CallNode c |
@@ -184,7 +184,8 @@ module AllocationSizeOverflow {
succ = c
)
or
succ.asExpr().(ArithmeticExpr).getAnOperand() = pred.asExpr()
succ.asExpr().(ArithmeticExpr).getAnOperand() = pred.asExpr() and
not succ.asExpr() instanceof RemExpr
}
/**