diff --git a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll index 05ca73caef4..25b456e9282 100644 --- a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll +++ b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll @@ -101,7 +101,8 @@ private module SizeBarrier { predicate isSource(DataFlow::Node source) { // The sources is the same as in the sources for the second // projection in the `AllocToInvalidPointerConfig` module. - hasSize(_, source, _) + hasSize(_, source, _) and + InterestingPointerAddInstruction::isInterestingSize(source) } /** @@ -220,6 +221,13 @@ private module InterestingPointerAddInstruction { flowTo(n) ) } + + predicate isInterestingSize(DataFlow::Node n) { + exists(DataFlow::Node alloc | + hasSize(alloc.asConvertedExpr(), n, _) and + flow(alloc, _) + ) + } } /**