C++: Limit flow through sinks and sources in cpp/upcast-array-pointer-arithmetic

jketema · jketema · commit 723778fa8282 · 2025-04-30T20:31:12.000+02:00
diff --git a/cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql b/cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql
@@ -44,6 +44,10 @@ module CastToPointerArithFlowConfig implements DataFlow::StateConfigSig {
     ) and
     getFullyConvertedType(node) = state
   }
+
+  predicate isBarrierIn(DataFlow::Node node) { isSource(node, _) }
+
+  predicate isBarrierOut(DataFlow::Node node) { isSink(node, _) }
 }
 
 /**

Original file line number	Diff line number	Diff line change
`@@ -44,6 +44,10 @@ module CastToPointerArithFlowConfig implements DataFlow::StateConfigSig {`
`44`	`44`	`) and`
`45`	`45`	`getFullyConvertedType(node) = state`
`46`	`46`	`}`
	`47`	`+`
	`48`	`+ predicate isBarrierIn(DataFlow::Node node) { isSource(node, _) }`
	`49`	`+`
	`50`	`+ predicate isBarrierOut(DataFlow::Node node) { isSink(node, _) }`
`47`	`51`	`}`
`48`	`52`
`49`	`53`	`/**`