Skip to content

Commit 7af4b8d

Browse files
committed
fix isBarrier according to code review
1 parent e421c49 commit 7af4b8d

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

go/ql/src/experimental/CWE-522-DecompressionBombs/DecompressionBombs.ql

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,12 @@ module DecompressionBombsConfig implements DataFlow::StateConfigSig {
4949

5050
predicate isBarrier(DataFlow::Node node) {
5151
// here I want to the CopyN return value be compared with < or > but I can't reach the tainted result
52-
exists(Function f | f.hasQualifiedName("io", "CopyN") |
53-
node = f.getACall().getArgument(1) and
54-
TaintTracking::localExprTaint(f.getACall().getResult(0).asExpr(),
55-
// only >=, <=,>,<
56-
any(RelationalComparisonExpr rce).getAnOperand())
52+
exists(Function f, DataFlow::CallNode cn |
53+
f.hasQualifiedName("io", "CopyN") and cn = f.getACall()
54+
|
55+
node = cn.getArgument(1) and
56+
TaintTracking::localTaint(cn.getResult(0),
57+
any(DataFlow::RelationalComparisonNode rcn).getAnOperand())
5758
)
5859
}
5960
}

0 commit comments

Comments
 (0)