Chris Smowton 83a7411a05 Improve accuracy of allocation-size-overflow by excluding len(...) calls that never see a large operand ...

This is achieved by splitting the query into two pieces: (1) trace flow from indefinitely large object creation to len(...) calls, then (2) considering those particular len(...) calls as taint propagators, trace taint from the same sources all the way to an allocation call. This is more accurate than the previous solution, which considered any len(...) call to propagate taint, potentially confusing an array that stored a large value in one of its cells for an array which is itself of large size.

2020-10-14 10:16:08 +01:00

..

AlertSuppression

Add Go autoformatting to the 'autoformat' make target and to CI

2020-07-08 14:20:19 +01:00

definitions

Go analysis support for CodeQL.

2019-11-08 12:16:26 +00:00

filters/ClassifyFiles

Update dependency stubs

2020-05-13 10:07:14 -07:00

InconsistentCode

Merge pull request #245 from smowton/smowton/feature/missing-error-check-query-conservative

2020-07-09 15:37:32 +01:00

RedundantCode

Fix tests for ExprHasNoEffect on non-Linux systems.

2020-08-25 08:05:19 +01:00

Security

Improve accuracy of allocation-size-overflow by excluding len(...) calls that never see a large operand

2020-10-14 10:16:08 +01:00