hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-23 07:45:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Add nodes query predicate to cpp/invalid-pointer-deref

Browse Source
This commit is contained in:
Jeroen Ketema
2023-05-30 18:43:01 +02:00
parent f5ed02a433
commit dd30acf1e3
2 changed files with 335 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
cpp/ql/src/experimental/Security/CWE/CWE-193/InvalidPointerDeref.ql
View File

@@ -324,6 +324,14 @@ query predicate edges(MergedPathNode node1, MergedPathNode node2) {
joinOn2(node1.asPathNode3(), node2.asSinkNode(), _, _)
}
query predicate nodes(MergedPathNode n, string key, string val) {
AllocToInvalidPointerFlow::PathGraph1::nodes(n.asPathNode1(), key, val)
or
InvalidPointerToDerefFlow::PathGraph::nodes(n.asPathNode3(), key, val)
or
key = "semmle.label" and val = n.asSinkNode().toString()
}
query predicate subpaths(
MergedPathNode arg, MergedPathNode par, MergedPathNode ret, MergedPathNode out
) {

327
cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected
View File

@@ -723,6 +723,333 @@ edges
| test.cpp:359:16:359:27 | end_plus_one | test.cpp:358:14:358:26 | Load: * ... |
| test.cpp:359:16:359:27 | end_plus_one | test.cpp:359:14:359:32 | Load: * ... |
| test.cpp:359:16:359:31 | ... + ... | test.cpp:359:14:359:32 | Load: * ... |
nodes
| test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
| test.cpp:5:15:5:15 | p | semmle.label | p |
| test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... |
| test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... |
| test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... |
| test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... |
| test.cpp:6:14:6:15 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:6:15:6:15 | q | semmle.label | q |
| test.cpp:6:15:6:15 | q | semmle.label | q |
| test.cpp:7:16:7:16 | q | semmle.label | q |
| test.cpp:7:16:7:16 | q | semmle.label | q |
| test.cpp:8:14:8:21 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:8:16:8:16 | q | semmle.label | q |
| test.cpp:8:16:8:16 | q | semmle.label | q |
| test.cpp:8:16:8:20 | ... + ... | semmle.label | ... + ... |
| test.cpp:9:16:9:16 | q | semmle.label | q |
| test.cpp:9:16:9:16 | q | semmle.label | q |
| test.cpp:10:16:10:16 | q | semmle.label | q |
| test.cpp:10:16:10:16 | q | semmle.label | q |
| test.cpp:11:16:11:16 | q | semmle.label | q |
| test.cpp:11:16:11:16 | q | semmle.label | q |
| test.cpp:12:16:12:16 | q | semmle.label | q |
| test.cpp:16:15:16:20 | call to malloc | semmle.label | call to malloc |
| test.cpp:17:15:17:15 | p | semmle.label | p |
| test.cpp:17:15:17:22 | ... + ... | semmle.label | ... + ... |
| test.cpp:20:14:20:21 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:20:16:20:20 | ... + ... | semmle.label | ... + ... |
| test.cpp:28:15:28:20 | call to malloc | semmle.label | call to malloc |
| test.cpp:29:15:29:15 | p | semmle.label | p |
| test.cpp:29:15:29:28 | ... + ... | semmle.label | ... + ... |
| test.cpp:29:15:29:28 | ... + ... | semmle.label | ... + ... |
| test.cpp:29:15:29:28 | ... + ... | semmle.label | ... + ... |
| test.cpp:29:15:29:28 | ... + ... | semmle.label | ... + ... |
| test.cpp:30:14:30:15 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:30:15:30:15 | q | semmle.label | q |
| test.cpp:30:15:30:15 | q | semmle.label | q |
| test.cpp:31:16:31:16 | q | semmle.label | q |
| test.cpp:31:16:31:16 | q | semmle.label | q |
| test.cpp:32:14:32:21 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:32:16:32:16 | q | semmle.label | q |
| test.cpp:32:16:32:16 | q | semmle.label | q |
| test.cpp:32:16:32:20 | ... + ... | semmle.label | ... + ... |
| test.cpp:33:16:33:16 | q | semmle.label | q |
| test.cpp:33:16:33:16 | q | semmle.label | q |
| test.cpp:34:16:34:16 | q | semmle.label | q |
| test.cpp:34:16:34:16 | q | semmle.label | q |
| test.cpp:35:16:35:16 | q | semmle.label | q |
| test.cpp:35:16:35:16 | q | semmle.label | q |
| test.cpp:36:16:36:16 | q | semmle.label | q |
| test.cpp:40:15:40:20 | call to malloc | semmle.label | call to malloc |
| test.cpp:41:15:41:15 | p | semmle.label | p |
| test.cpp:41:15:41:28 | ... + ... | semmle.label | ... + ... |
| test.cpp:41:15:41:28 | ... + ... | semmle.label | ... + ... |
| test.cpp:41:15:41:28 | ... + ... | semmle.label | ... + ... |
| test.cpp:41:15:41:28 | ... + ... | semmle.label | ... + ... |
| test.cpp:42:14:42:15 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:42:15:42:15 | q | semmle.label | q |
| test.cpp:42:15:42:15 | q | semmle.label | q |
| test.cpp:43:16:43:16 | q | semmle.label | q |
| test.cpp:43:16:43:16 | q | semmle.label | q |
| test.cpp:44:14:44:21 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:44:16:44:16 | q | semmle.label | q |
| test.cpp:44:16:44:16 | q | semmle.label | q |
| test.cpp:44:16:44:20 | ... + ... | semmle.label | ... + ... |
| test.cpp:45:16:45:16 | q | semmle.label | q |
| test.cpp:45:16:45:16 | q | semmle.label | q |
| test.cpp:46:16:46:16 | q | semmle.label | q |
| test.cpp:46:16:46:16 | q | semmle.label | q |
| test.cpp:47:16:47:16 | q | semmle.label | q |
| test.cpp:47:16:47:16 | q | semmle.label | q |
| test.cpp:48:16:48:16 | q | semmle.label | q |
| test.cpp:51:7:51:14 | mk_array indirection | semmle.label | mk_array indirection |
| test.cpp:51:33:51:35 | end | semmle.label | end |
| test.cpp:52:19:52:24 | call to malloc | semmle.label | call to malloc |
| test.cpp:53:5:53:23 | ... = ... | semmle.label | ... = ... |
| test.cpp:53:12:53:16 | begin | semmle.label | begin |
| test.cpp:53:12:53:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:60:19:60:26 | call to mk_array | semmle.label | call to mk_array |
| test.cpp:60:34:60:37 | mk_array output argument | semmle.label | mk_array output argument |
| test.cpp:62:32:62:34 | end | semmle.label | end |
| test.cpp:62:39:62:39 | p | semmle.label | p |
| test.cpp:66:32:66:34 | end | semmle.label | end |
| test.cpp:66:39:66:39 | p | semmle.label | p |
| test.cpp:67:9:67:14 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:70:31:70:33 | end | semmle.label | end |
| test.cpp:70:38:70:38 | p | semmle.label | p |
| test.cpp:80:9:80:16 | mk_array indirection [begin] | semmle.label | mk_array indirection [begin] |
| test.cpp:80:9:80:16 | mk_array indirection [end] | semmle.label | mk_array indirection [end] |
| test.cpp:82:5:82:28 | ... = ... | semmle.label | ... = ... |
| test.cpp:82:9:82:13 | arr indirection [post update] [begin] | semmle.label | arr indirection [post update] [begin] |
| test.cpp:82:17:82:22 | call to malloc | semmle.label | call to malloc |
| test.cpp:83:5:83:30 | ... = ... | semmle.label | ... = ... |
| test.cpp:83:9:83:11 | arr indirection [post update] [end] | semmle.label | arr indirection [post update] [end] |
| test.cpp:83:15:83:17 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:83:15:83:30 | ... + ... | semmle.label | ... + ... |
| test.cpp:83:19:83:23 | begin | semmle.label | begin |
| test.cpp:83:19:83:23 | begin indirection | semmle.label | begin indirection |
| test.cpp:89:19:89:26 | call to mk_array [begin] | semmle.label | call to mk_array [begin] |
| test.cpp:89:19:89:26 | call to mk_array [end] | semmle.label | call to mk_array [end] |
| test.cpp:91:20:91:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:91:24:91:28 | begin | semmle.label | begin |
| test.cpp:91:24:91:28 | begin indirection | semmle.label | begin indirection |
| test.cpp:91:36:91:38 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:91:40:91:42 | end | semmle.label | end |
| test.cpp:91:40:91:42 | end indirection | semmle.label | end indirection |
| test.cpp:91:47:91:47 | p | semmle.label | p |
| test.cpp:95:20:95:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:95:24:95:28 | begin | semmle.label | begin |
| test.cpp:95:24:95:28 | begin indirection | semmle.label | begin indirection |
| test.cpp:95:36:95:38 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:95:40:95:42 | end | semmle.label | end |
| test.cpp:95:40:95:42 | end indirection | semmle.label | end indirection |
| test.cpp:95:47:95:47 | p | semmle.label | p |
| test.cpp:96:9:96:14 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:99:20:99:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:99:24:99:28 | begin | semmle.label | begin |
| test.cpp:99:24:99:28 | begin indirection | semmle.label | begin indirection |
| test.cpp:99:35:99:37 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:99:39:99:41 | end | semmle.label | end |
| test.cpp:99:39:99:41 | end indirection | semmle.label | end indirection |
| test.cpp:99:46:99:46 | p | semmle.label | p |
| test.cpp:104:27:104:29 | arr [begin] | semmle.label | arr [begin] |
| test.cpp:104:27:104:29 | arr [end] | semmle.label | arr [end] |
| test.cpp:105:20:105:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:105:24:105:28 | begin | semmle.label | begin |
| test.cpp:105:24:105:28 | begin indirection | semmle.label | begin indirection |
| test.cpp:105:36:105:38 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:105:40:105:42 | end | semmle.label | end |
| test.cpp:105:40:105:42 | end indirection | semmle.label | end indirection |
| test.cpp:105:47:105:47 | p | semmle.label | p |
| test.cpp:109:20:109:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:109:24:109:28 | begin | semmle.label | begin |
| test.cpp:109:24:109:28 | begin indirection | semmle.label | begin indirection |
| test.cpp:109:36:109:38 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:109:40:109:42 | end | semmle.label | end |
| test.cpp:109:40:109:42 | end indirection | semmle.label | end indirection |
| test.cpp:109:47:109:47 | p | semmle.label | p |
| test.cpp:110:9:110:14 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:113:20:113:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:113:24:113:28 | begin | semmle.label | begin |
| test.cpp:113:24:113:28 | begin indirection | semmle.label | begin indirection |
| test.cpp:113:35:113:37 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:113:39:113:41 | end | semmle.label | end |
| test.cpp:113:39:113:41 | end indirection | semmle.label | end indirection |
| test.cpp:113:46:113:46 | p | semmle.label | p |
| test.cpp:119:18:119:25 | call to mk_array [begin] | semmle.label | call to mk_array [begin] |
| test.cpp:119:18:119:25 | call to mk_array [end] | semmle.label | call to mk_array [end] |
| test.cpp:124:15:124:20 | call to malloc | semmle.label | call to malloc |
| test.cpp:125:5:125:17 | ... = ... | semmle.label | ... = ... |
| test.cpp:125:9:125:13 | arr indirection [post update] [begin] | semmle.label | arr indirection [post update] [begin] |
| test.cpp:126:15:126:15 | p | semmle.label | p |
| test.cpp:129:11:129:13 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:129:15:129:19 | begin | semmle.label | begin |
| test.cpp:129:15:129:19 | begin indirection | semmle.label | begin indirection |
| test.cpp:133:11:133:13 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:133:15:133:19 | begin | semmle.label | begin |
| test.cpp:133:15:133:19 | begin indirection | semmle.label | begin indirection |
| test.cpp:137:11:137:13 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:137:15:137:19 | begin | semmle.label | begin |
| test.cpp:137:15:137:19 | begin indirection | semmle.label | begin indirection |
| test.cpp:141:10:141:19 | mk_array_p indirection [begin] | semmle.label | mk_array_p indirection [begin] |
| test.cpp:141:10:141:19 | mk_array_p indirection [end] | semmle.label | mk_array_p indirection [end] |
| test.cpp:143:5:143:29 | ... = ... | semmle.label | ... = ... |
| test.cpp:143:10:143:14 | arr indirection [post update] [begin] | semmle.label | arr indirection [post update] [begin] |
| test.cpp:143:18:143:23 | call to malloc | semmle.label | call to malloc |
| test.cpp:144:5:144:32 | ... = ... | semmle.label | ... = ... |
| test.cpp:144:10:144:12 | arr indirection [post update] [end] | semmle.label | arr indirection [post update] [end] |
| test.cpp:144:16:144:18 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:144:16:144:32 | ... + ... | semmle.label | ... + ... |
| test.cpp:144:21:144:25 | begin | semmle.label | begin |
| test.cpp:144:21:144:25 | begin indirection | semmle.label | begin indirection |
| test.cpp:150:20:150:29 | call to mk_array_p indirection [begin] | semmle.label | call to mk_array_p indirection [begin] |
| test.cpp:150:20:150:29 | call to mk_array_p indirection [end] | semmle.label | call to mk_array_p indirection [end] |
| test.cpp:152:20:152:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:152:25:152:29 | begin | semmle.label | begin |
| test.cpp:152:25:152:29 | begin indirection | semmle.label | begin indirection |
| test.cpp:152:49:152:49 | p | semmle.label | p |
| test.cpp:156:20:156:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:156:25:156:29 | begin | semmle.label | begin |
| test.cpp:156:25:156:29 | begin indirection | semmle.label | begin indirection |
| test.cpp:156:37:156:39 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:156:42:156:44 | end | semmle.label | end |
| test.cpp:156:42:156:44 | end indirection | semmle.label | end indirection |
| test.cpp:156:49:156:49 | p | semmle.label | p |
| test.cpp:157:9:157:14 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:160:20:160:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:160:25:160:29 | begin | semmle.label | begin |
| test.cpp:160:25:160:29 | begin indirection | semmle.label | begin indirection |
| test.cpp:160:48:160:48 | p | semmle.label | p |
| test.cpp:165:29:165:31 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:165:29:165:31 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:166:20:166:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:166:25:166:29 | begin | semmle.label | begin |
| test.cpp:166:25:166:29 | begin indirection | semmle.label | begin indirection |
| test.cpp:166:37:166:39 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:166:42:166:44 | end | semmle.label | end |
| test.cpp:166:42:166:44 | end indirection | semmle.label | end indirection |
| test.cpp:166:49:166:49 | p | semmle.label | p |
| test.cpp:170:20:170:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:170:25:170:29 | begin | semmle.label | begin |
| test.cpp:170:25:170:29 | begin indirection | semmle.label | begin indirection |
| test.cpp:170:37:170:39 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:170:42:170:44 | end | semmle.label | end |
| test.cpp:170:42:170:44 | end indirection | semmle.label | end indirection |
| test.cpp:170:49:170:49 | p | semmle.label | p |
| test.cpp:171:9:171:14 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:174:20:174:22 | arr indirection [begin] | semmle.label | arr indirection [begin] |
| test.cpp:174:25:174:29 | begin | semmle.label | begin |
| test.cpp:174:25:174:29 | begin indirection | semmle.label | begin indirection |
| test.cpp:174:36:174:38 | arr indirection [end] | semmle.label | arr indirection [end] |
| test.cpp:174:41:174:43 | end | semmle.label | end |
| test.cpp:174:41:174:43 | end indirection | semmle.label | end indirection |
| test.cpp:174:48:174:48 | p | semmle.label | p |
| test.cpp:180:19:180:28 | call to mk_array_p indirection [begin] | semmle.label | call to mk_array_p indirection [begin] |
| test.cpp:180:19:180:28 | call to mk_array_p indirection [end] | semmle.label | call to mk_array_p indirection [end] |
| test.cpp:188:15:188:20 | call to malloc | semmle.label | call to malloc |
| test.cpp:189:15:189:15 | p | semmle.label | p |
| test.cpp:194:23:194:28 | call to malloc | semmle.label | call to malloc |
| test.cpp:195:17:195:17 | p | semmle.label | p |
| test.cpp:195:17:195:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:195:17:195:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:195:17:195:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:195:17:195:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:197:8:197:8 | p | semmle.label | p |
| test.cpp:197:20:197:22 | end | semmle.label | end |
| test.cpp:201:5:201:5 | p | semmle.label | p |
| test.cpp:201:5:201:12 | access to array | semmle.label | access to array |
| test.cpp:201:5:201:19 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:205:23:205:28 | call to malloc | semmle.label | call to malloc |
| test.cpp:206:17:206:17 | p | semmle.label | p |
| test.cpp:206:17:206:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:206:17:206:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:206:17:206:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:206:17:206:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:208:15:208:15 | p | semmle.label | p |
| test.cpp:209:12:209:14 | end | semmle.label | end |
| test.cpp:213:5:213:6 | * ... | semmle.label | * ... |
| test.cpp:213:5:213:13 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:213:6:213:6 | q | semmle.label | q |
| test.cpp:213:6:213:6 | q | semmle.label | q |
| test.cpp:221:17:221:22 | call to malloc | semmle.label | call to malloc |
| test.cpp:222:5:222:5 | p | semmle.label | p |
| test.cpp:231:18:231:30 | new[] | semmle.label | new[] |
| test.cpp:232:3:232:9 | newname | semmle.label | newname |
| test.cpp:232:3:232:16 | access to array | semmle.label | access to array |
| test.cpp:232:3:232:20 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:238:20:238:32 | new[] | semmle.label | new[] |
| test.cpp:239:5:239:11 | newname | semmle.label | newname |
| test.cpp:239:5:239:18 | access to array | semmle.label | access to array |
| test.cpp:239:5:239:22 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:248:24:248:30 | call to realloc | semmle.label | call to realloc |
| test.cpp:249:9:249:9 | p | semmle.label | p |
| test.cpp:250:22:250:22 | p | semmle.label | p |
| test.cpp:254:9:254:9 | p | semmle.label | p |
| test.cpp:254:9:254:12 | access to array | semmle.label | access to array |
| test.cpp:254:9:254:16 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:260:13:260:24 | new[] | semmle.label | new[] |
| test.cpp:261:14:261:15 | xs | semmle.label | xs |
| test.cpp:261:14:261:21 | ... + ... | semmle.label | ... + ... |
| test.cpp:261:14:261:21 | ... + ... | semmle.label | ... + ... |
| test.cpp:261:14:261:21 | ... + ... | semmle.label | ... + ... |
| test.cpp:261:14:261:21 | ... + ... | semmle.label | ... + ... |
| test.cpp:262:26:262:28 | end | semmle.label | end |
| test.cpp:262:26:262:28 | end | semmle.label | end |
| test.cpp:262:31:262:31 | x | semmle.label | x |
| test.cpp:264:13:264:14 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:264:14:264:14 | x | semmle.label | x |
| test.cpp:264:14:264:14 | x | semmle.label | x |
| test.cpp:270:13:270:24 | new[] | semmle.label | new[] |
| test.cpp:271:14:271:15 | xs | semmle.label | xs |
| test.cpp:271:14:271:21 | ... + ... | semmle.label | ... + ... |
| test.cpp:271:14:271:21 | ... + ... | semmle.label | ... + ... |
| test.cpp:271:14:271:21 | ... + ... | semmle.label | ... + ... |
| test.cpp:271:14:271:21 | ... + ... | semmle.label | ... + ... |
| test.cpp:272:26:272:28 | end | semmle.label | end |
| test.cpp:272:26:272:28 | end | semmle.label | end |
| test.cpp:272:31:272:31 | x | semmle.label | x |
| test.cpp:272:31:272:31 | x | semmle.label | x |
| test.cpp:274:5:274:6 | * ... | semmle.label | * ... |
| test.cpp:274:5:274:10 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:274:6:274:6 | x | semmle.label | x |
| test.cpp:274:6:274:6 | x | semmle.label | x |
| test.cpp:280:13:280:24 | new[] | semmle.label | new[] |
| test.cpp:281:14:281:15 | xs | semmle.label | xs |
| test.cpp:290:13:290:24 | new[] | semmle.label | new[] |
| test.cpp:291:14:291:15 | xs | semmle.label | xs |
| test.cpp:292:30:292:30 | x | semmle.label | x |
| test.cpp:304:15:304:26 | new[] | semmle.label | new[] |
| test.cpp:307:5:307:6 | xs | semmle.label | xs |
| test.cpp:308:5:308:6 | xs | semmle.label | xs |
| test.cpp:308:5:308:11 | access to array | semmle.label | access to array |
| test.cpp:308:5:308:29 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:313:14:313:27 | new[] | semmle.label | new[] |
| test.cpp:314:15:314:16 | xs | semmle.label | xs |
| test.cpp:325:14:325:27 | new[] | semmle.label | new[] |
| test.cpp:326:15:326:16 | xs | semmle.label | xs |
| test.cpp:326:15:326:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:326:15:326:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:333:5:333:21 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:338:8:338:15 | * ... | semmle.label | * ... |
| test.cpp:341:5:341:21 | Store: ... = ... | semmle.label | Store: ... = ... |
| test.cpp:341:8:341:17 | * ... | semmle.label | * ... |
| test.cpp:342:8:342:17 | * ... | semmle.label | * ... |
| test.cpp:347:14:347:27 | new[] | semmle.label | new[] |
| test.cpp:348:15:348:16 | xs | semmle.label | xs |
| test.cpp:350:15:350:19 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:350:16:350:19 | ... ++ | semmle.label | ... ++ |
| test.cpp:350:16:350:19 | ... ++ | semmle.label | ... ++ |
| test.cpp:350:16:350:19 | ... ++ | semmle.label | ... ++ |
| test.cpp:355:14:355:27 | new[] | semmle.label | new[] |
| test.cpp:356:15:356:16 | xs | semmle.label | xs |
| test.cpp:356:15:356:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:356:15:356:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:356:15:356:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:356:15:356:23 | ... + ... | semmle.label | ... + ... |
| test.cpp:357:24:357:26 | end | semmle.label | end |
| test.cpp:357:24:357:30 | ... + ... | semmle.label | ... + ... |
| test.cpp:357:24:357:30 | ... + ... | semmle.label | ... + ... |
| test.cpp:357:24:357:30 | ... + ... | semmle.label | ... + ... |
| test.cpp:357:24:357:30 | ... + ... | semmle.label | ... + ... |
| test.cpp:358:14:358:26 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:358:15:358:26 | end_plus_one | semmle.label | end_plus_one |
| test.cpp:358:15:358:26 | end_plus_one | semmle.label | end_plus_one |
| test.cpp:359:14:359:32 | Load: * ... | semmle.label | Load: * ... |
| test.cpp:359:16:359:27 | end_plus_one | semmle.label | end_plus_one |
| test.cpp:359:16:359:31 | ... + ... | semmle.label | ... + ... |
subpaths
#select
| test.cpp:6:14:6:15 | Load: * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | Load: * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |