C++: Fix FP by also excluding indirections of array expressions.

MathiasVP · MathiasVP · commit 4079de125ffa · 2024-06-13T10:59:39.000+01:00
diff --git a/cpp/ql/lib/semmle/code/cpp/security/flowafterfree/FlowAfterFree.qll b/cpp/ql/lib/semmle/code/cpp/security/flowafterfree/FlowAfterFree.qll
@@ -95,7 +95,7 @@ module FlowFromFree<FlowFromFreeParamSig P> {
         e = any(StoreInstruction store).getDestinationAddress().getUnconvertedResultExpression()
       )
       or
-      n.asExpr() instanceof ArrayExpr
+      [n.asExpr(), n.asIndirectExpr()] instanceof ArrayExpr
     }
   }
 

Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,7 @@ module FlowFromFree<FlowFromFreeParamSig P> {`
`95`	`95`	`e = any(StoreInstruction store).getDestinationAddress().getUnconvertedResultExpression()`
`96`	`96`	`)`
`97`	`97`	`or`
`98`		`- n.asExpr() instanceof ArrayExpr`
	`98`	`+ [n.asExpr(), n.asIndirectExpr()] instanceof ArrayExpr`
`99`	`99`	`}`
`100`	`100`	`}`
`101`	`101`