Update cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll

MathiasVP · geoffw0 · web-flow · commit 369cee9ed9eb · 2023-07-21T09:32:14.000+01:00
Co-authored-by: Geoffrey White &lt;40627776+geoffw0@users.noreply.github.com&gt;
diff --git a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll
@@ -21,7 +21,7 @@
  * actually being dereferenced. We do this using a regular dataflow configuration (see `InvalidPointerToDerefConfig`).
  *
  * This dataflow traversal defines the set of sources as any dataflow node that is non-strictly upper-bounded by the
- * pointer-arithmetic instruction identified by `AllocationToInvalidPointer.qll`. (TOOD: I'm pretty sure this is incorrect,
+ * pointer-arithmetic instruction identified by `AllocationToInvalidPointer.qll`. (TODO: I'm pretty sure this is incorrect,
  * and we should define the set of sources as anything that is non-strictly _lower_ bounded by the pointer-arithmetic
  * instruction). That is, the set of sources is any dataflow node `source` such that `source.asInstruction <= pai + delta1`
  * for some `delta1 >= 0`.

Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@`
`21`	`21`	* actually being dereferenced. We do this using a regular dataflow configuration (see `InvalidPointerToDerefConfig`).
`22`	`22`	`*`
`23`	`23`	`* This dataflow traversal defines the set of sources as any dataflow node that is non-strictly upper-bounded by the`
`24`		- * pointer-arithmetic instruction identified by `AllocationToInvalidPointer.qll`. (TOOD: I'm pretty sure this is incorrect,
	`24`	+ * pointer-arithmetic instruction identified by `AllocationToInvalidPointer.qll`. (TODO: I'm pretty sure this is incorrect,
`25`	`25`	`* and we should define the set of sources as anything that is non-strictly _lower_ bounded by the pointer-arithmetic`
`26`	`26`	* instruction). That is, the set of sources is any dataflow node `source` such that `source.asInstruction <= pai + delta1`
`27`	`27`	* for some `delta1 >= 0`.