C++/TaintedAllocationSize

d10c · d10c · commit a65d4d59975b · 2025-10-28T09:42:01.000+01:00
diff --git a/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql b/cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql
@@ -95,7 +95,7 @@ module TaintedAllocationSizeConfig implements DataFlow::ConfigSig {
   predicate observeDiffInformedIncrementalMode() { any() }
 
   Location getASelectedSinkLocation(DataFlow::Node sink) {
-    exists(Expr alloc | result = alloc.getLocation() | allocSink(alloc, sink))
+    exists(Expr alloc | result = [alloc.getLocation(), sink.getLocation()] | allocSink(alloc, sink))
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,7 @@ module TaintedAllocationSizeConfig implements DataFlow::ConfigSig {`
`95`	`95`	`predicate observeDiffInformedIncrementalMode() { any() }`
`96`	`96`
`97`	`97`	`Location getASelectedSinkLocation(DataFlow::Node sink) {`
`98`		`- exists(Expr alloc \| result = alloc.getLocation() \| allocSink(alloc, sink))`
	`98`	`+ exists(Expr alloc \| result = [alloc.getLocation(), sink.getLocation()] \| allocSink(alloc, sink))`
`99`	`99`	`}`
`100`	`100`	`}`
`101`	`101`