hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 03:06:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

C++: Fix joins.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-06-26 11:28:32 +01:00
parent e0f5c584b9
commit b87bf46c30
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.ql
View File

@@ -131,8 +131,10 @@ module Barrier2 {
} }
Instruction getABarrierInstruction(FlowState2 state) { Instruction getABarrierInstruction(FlowState2 state) {
exists(IRGuardCondition g, ValueNumber value, boolean edge | exists(IRGuardCondition g, ValueNumber value, Operand use, boolean edge |
operandGuardChecks(g, value.getAUse(), _, state, edge) and use = value.getAUse() and
operandGuardChecks(pragma[only_bind_into](g), pragma[only_bind_into](use), _,
pragma[only_bind_into](state), pragma[only_bind_into](edge)) and
result = value.getAnInstruction() and result = value.getAnInstruction() and
g.controls(result.getBlock(), edge) g.controls(result.getBlock(), edge)
) )
@@ -239,11 +241,13 @@ pragma[nomagic]
predicate pointerAddInstructionHasBounds( predicate pointerAddInstructionHasBounds(
PointerAddInstruction pai, DataFlow::Node sink1, DataFlow::Node sink2, int delta PointerAddInstruction pai, DataFlow::Node sink1, DataFlow::Node sink2, int delta
) { ) {
exists(Instruction right | exists(Instruction right, Instruction instr2 |
pai.getRight() = right and pai.getRight() = right and
pai.getLeft() = sink1.asInstruction() and pai.getLeft() = sink1.asInstruction() and
bounded1(right, sink2.asInstruction(), delta) and instr2 = sink2.asInstruction() and
not [right, sink2.asInstruction()] = Barrier2::getABarrierInstruction(delta) bounded1(right, instr2, delta) and
not right = Barrier2::getABarrierInstruction(delta) and
not instr2 = Barrier2::getABarrierInstruction(delta)
) )
} }