diff --git a/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll b/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll index e641e50532f..405eb44c7a9 100644 --- a/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll +++ b/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll @@ -120,12 +120,8 @@ private int isSource(Expr bufferExpr, Element why) { exists(Variable bufferVar | bufferVar = bufferExpr.(VariableAccess).getTarget() | // buffer is a fixed size array exists(bufferVar.getUnspecifiedType().(ArrayType).getSize()) and - result = - unique(int size | // more generous than .getSize() itself, when the array is a class field or similar. - size = getSize(bufferExpr) - | - size - ) and + // more generous than .getSize() itself, when the array is a class field or similar. + result = getSize(bufferExpr) and why = bufferVar and not memberMayBeVarSize(_, bufferVar) and not exists(BuiltInOperationBuiltInOffsetOf offsetof | offsetof.getAChild*() = bufferExpr) and