@@ -2,57 +2,6 @@ import cpp
22import semmle.code.cpp.dataflow.DataFlow
33import semmle.code.cpp.controlflow.Guards
44import semmle.code.cpp.valuenumbering.GlobalValueNumbering
5- import semmle.code.cpp.dataflow.TaintTracking
6- private import semmle.code.cpp.dataflow.RecursionPrevention
7-
8- /**
9- * A buffer which includes an allocation size.
10- */
11- abstract class BufferWithSize extends DataFlow:: Node {
12- abstract Expr getSizeExpr ( ) ;
13-
14- BufferAccess getAnAccess ( ) {
15- any ( BufferWithSizeConfig bsc ) .hasFlow ( this , DataFlow:: exprNode ( result .getPointer ( ) ) )
16- }
17- }
18-
19- /** An allocation function. */
20- abstract class Alloc extends Function { }
21-
22- /**
23- * Allocation functions identified by the QL for C/C++ standard library.
24- */
25- class DefaultAlloc extends Alloc {
26- DefaultAlloc ( ) { allocationFunction ( this ) }
27- }
28-
29- /** A buffer created through a call to an allocation function. */
30- class AllocBuffer extends BufferWithSize {
31- FunctionCall call ;
32-
33- AllocBuffer ( ) {
34- asExpr ( ) = call and
35- call .getTarget ( ) instanceof Alloc
36- }
37-
38- override Expr getSizeExpr ( ) { result = call .getArgument ( 0 ) }
39- }
40-
41- /**
42- * Find accesses of buffers for which we have a size expression.
43- */
44- private class BufferWithSizeConfig extends TaintTracking:: Configuration {
45- BufferWithSizeConfig ( ) { this = "BufferWithSize" }
46-
47- override predicate isSource ( DataFlow:: Node n ) { n = any ( BufferWithSize b ) }
48-
49- override predicate isSink ( DataFlow:: Node n ) { n .asExpr ( ) = any ( BufferAccess ae ) .getPointer ( ) }
50-
51- override predicate isSanitizer ( DataFlow:: Node s ) {
52- s = any ( BufferWithSize b ) and
53- s .asExpr ( ) .getControlFlowScope ( ) instanceof Alloc
54- }
55- }
565
576/**
587 * An access (read or write) to a buffer, provided as a pair of
0 commit comments