Update CompilerRemovalOfCodeToClearBuffers.ql

ihsinme · web-flow · commit 4c9de4574a91 · 2021-01-20T16:24:43.000+03:00
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql b/cpp/ql/src/experimental/Security/CWE/CWE-14/CompilerRemovalOfCodeToClearBuffers.ql
@@ -12,6 +12,7 @@
 
 import cpp
 import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.dataflow.StackAddress
 
 /**
  * A call to `memset` of the form `memset(ptr, value, num)`, for some local variable `ptr`.
@@ -34,6 +35,8 @@ class CompilerRemovaMemset extends FunctionCall {
       this.getArgument(0) = v.getAnAccess() and
       alloc.getASuccessor+() = this
     )
+    or
+    not stackPointerFlowsToUse(this.getArgument(0), _, _, _)
   }
 
   predicate isExistsFreeForThisVariable() {

Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@`
`12`	`12`
`13`	`13`	`import cpp`
`14`	`14`	`import semmle.code.cpp.dataflow.DataFlow`
	`15`	`+import semmle.code.cpp.dataflow.StackAddress`
`15`	`16`
`16`	`17`	`/**`
`17`	`18`	* A call to `memset` of the form `memset(ptr, value, num)`, for some local variable `ptr`.
`@@ -34,6 +35,8 @@ class CompilerRemovaMemset extends FunctionCall {`
`34`	`35`	`this.getArgument(0) = v.getAnAccess() and`
`35`	`36`	`alloc.getASuccessor+() = this`
`36`	`37`	`)`
	`38`	`+ or`
	`39`	`+ not stackPointerFlowsToUse(this.getArgument(0), _, _, _)`
`37`	`40`	`}`
`38`	`41`
`39`	`42`	`predicate isExistsFreeForThisVariable() {`