From e5e74f34d7504951f8c4e2ef9ab12e02fdee152f Mon Sep 17 00:00:00 2001 From: Slavomir Date: Tue, 12 May 2020 13:06:11 +0300 Subject: [PATCH] Add note on why the zero is commented out in Lt32BitFlowConfig --- ql/src/experimental/CWE-681/IncorrectNumericConversion.ql | 1 + 1 file changed, 1 insertion(+) diff --git a/ql/src/experimental/CWE-681/IncorrectNumericConversion.ql b/ql/src/experimental/CWE-681/IncorrectNumericConversion.ql index 0b157a879e9..60116a65111 100644 --- a/ql/src/experimental/CWE-681/IncorrectNumericConversion.ql +++ b/ql/src/experimental/CWE-681/IncorrectNumericConversion.ql @@ -144,6 +144,7 @@ class Lt32BitFlowConfig extends TaintTracking::Configuration, DataFlow::Configur Lt32BitFlowConfig() { this = "Lt32BitFlowConfig" } override predicate isSource(DataFlow::Node source) { + // NOTE: target bit size 0 is already addressed in Lt64BitFlowConfig. exists(ParserCall call | call.getTargetBitSize() = [/*0,*/ 32] | source = call) }