C++: Add indirect barrier guard to 'cpp/unbounded-write' to prevent FPs after fixing conflation.

MathiasVP · MathiasVP · commit 6da7890ff528 · 2026-01-15T18:31:54.000Z
diff --git a/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql b/cpp/ql/src/Security/CWE/CWE-120/UnboundedWrite.ql
@@ -122,7 +122,8 @@ module Config implements DataFlow::ConfigSig {
 
   predicate isBarrier(DataFlow::Node node) {
     // Block flow if the node is guarded by any <, <= or = operations.
-    node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getABarrierNode()
+    node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getABarrierNode() or
+    node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getAnIndirectBarrierNode()
   }
 
   predicate observeDiffInformedIncrementalMode() { any() }

Original file line number	Diff line number	Diff line change
`@@ -122,7 +122,8 @@ module Config implements DataFlow::ConfigSig {`
`122`	`122`
`123`	`123`	`predicate isBarrier(DataFlow::Node node) {`
`124`	`124`	`// Block flow if the node is guarded by any <, <= or = operations.`
`125`		`- node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getABarrierNode()`
	`125`	`+ node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getABarrierNode() or`
	`126`	`+ node = DataFlow::BarrierGuard<lessThanOrEqual/3>::getAnIndirectBarrierNode()`
`126`	`127`	`}`
`127`	`128`
`128`	`129`	`predicate observeDiffInformedIncrementalMode() { any() }`