File tree Expand file tree Collapse file tree 1 file changed +4
-9
lines changed
cpp/ql/src/experimental/Likely Bugs Expand file tree Collapse file tree 1 file changed +4
-9
lines changed Original file line number Diff line number Diff line change @@ -159,17 +159,12 @@ module ValidState {
159
159
// For a dataflow sink any `value` that is strictly smaller than the delta
160
160
// needs to be a valid flow-state. That is, for a snippet like:
161
161
// ```
162
- // p = new char[size];
162
+ // p = b ? new char[size] : new char[size + 1 ];
163
163
// memset(p, 0, size + 2);
164
164
// ```
165
- // the valid flow-states at the `memset` must include `0` since the flow-state
166
- // at the source is `0`. Similarly, for an example such as:
167
- // ```
168
- // p = new char[size + 1];
169
- // memset(p, 0, size + 2);
170
- // ```
171
- // the flow-state at the `memset` must include `1` since `1` is the flow-state
172
- // after the source.
165
+ // the valid flow-states at the `memset` must include set set `{0, 1}` since the
166
+ // flow-state at `new char[size]` is `0`, and the flow-state at `new char[size + 1]`
167
+ // is `1`.
173
168
//
174
169
// So we find a valid flow-state at the sink's predecessor, and use the definition
175
170
// of our sink predicate to compute the valid flow-states at the sink.
You can’t perform that action at this time.
0 commit comments