Skip to content

Commit 1fa6511

Browse files
MathiasVPMathiasVP
authored
Merge pull request github#13792 from MathiasVP/swap-argument-order-in-invalid-ptr-deref
C++: Swap argument order in `cpp/invalid-pointer-deref`
2 parents 4676ca5 + 786c6e1 commit 1fa6511

File tree

4 files changed

+20
-94
lines changed

4 files changed

+20
-94
lines changed

‎cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -102,9 +102,11 @@ private predicate invalidPointerToDerefSource(
102102
// `deltaDerefSourceAndPai` is the constant difference between the pointer-arithmetic instruction
103103
// and the instruction computing the address for which we will search for a dereference.
104104
AllocToInvalidPointer::pointerAddInstructionHasBounds(allocSource, pai, _, rhsSizeDelta) and
105-
bounded2(derefSource.asInstruction(), pai, deltaDerefSourceAndPai) and
106-
deltaDerefSourceAndPai >= 0 and
107-
// TODO: This condition will go away once #13725 is merged, and then we can make `SizeBarrier`
105+
// pai <= derefSource + deltaDerefSourceAndPai and deltaDerefSourceAndPai <= 0 is equivalent to
106+
// derefSource >= pai + deltaDerefSourceAndPai and deltaDerefSourceAndPai >= 0
107+
bounded1(pai, derefSource.asInstruction(), deltaDerefSourceAndPai) and
108+
deltaDerefSourceAndPai <= 0 and
109+
// TODO: This condition will go away once #13725 is merged, and then we can make `Barrier2`
108110
// private to `AllocationToInvalidPointer.qll`.
109111
not derefSource.getBasicBlock() =
110112
AllocToInvalidPointer::SizeBarrier::getABarrierBlock(rhsSizeDelta)

‎cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/RangeAnalysisUtil.qll

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,5 @@ bindingset[i]
3535
pragma[inline_late]
3636
predicate bounded1(Instruction i, Instruction b, int delta) { boundedImpl(i, b, delta) }
3737

38-
/**
39-
* Holds if `i <= b + delta`.
40-
*
41-
* This predicate enforces a join-order that ensures that `b` has already been bound.
42-
*/
43-
bindingset[b]
44-
pragma[inline_late]
45-
predicate bounded2(Instruction i, Instruction b, int delta) { boundedImpl(i, b, delta) }
46-
4738
/** Holds if `i <= b + delta`. */
4839
predicate bounded = boundedImpl/3;

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/InvalidPointerDeref.expected

Lines changed: 0 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -132,97 +132,53 @@ edges
132132
| test.cpp:304:15:304:26 | new[] | test.cpp:308:5:308:29 | ... = ... |
133133
| test.cpp:355:14:355:27 | new[] | test.cpp:356:15:356:23 | ... + ... |
134134
| test.cpp:355:14:355:27 | new[] | test.cpp:356:15:356:23 | ... + ... |
135-
| test.cpp:355:14:355:27 | new[] | test.cpp:357:24:357:30 | ... + ... |
136-
| test.cpp:355:14:355:27 | new[] | test.cpp:357:24:357:30 | ... + ... |
137135
| test.cpp:355:14:355:27 | new[] | test.cpp:358:14:358:26 | * ... |
138136
| test.cpp:355:14:355:27 | new[] | test.cpp:359:14:359:32 | * ... |
139137
| test.cpp:356:15:356:23 | ... + ... | test.cpp:356:15:356:23 | ... + ... |
140138
| test.cpp:356:15:356:23 | ... + ... | test.cpp:358:14:358:26 | * ... |
141139
| test.cpp:356:15:356:23 | ... + ... | test.cpp:358:14:358:26 | * ... |
142140
| test.cpp:356:15:356:23 | ... + ... | test.cpp:359:14:359:32 | * ... |
143141
| test.cpp:356:15:356:23 | ... + ... | test.cpp:359:14:359:32 | * ... |
144-
| test.cpp:357:24:357:30 | ... + ... | test.cpp:357:24:357:30 | ... + ... |
145-
| test.cpp:357:24:357:30 | ... + ... | test.cpp:358:14:358:26 | * ... |
146-
| test.cpp:357:24:357:30 | ... + ... | test.cpp:358:14:358:26 | * ... |
147-
| test.cpp:357:24:357:30 | ... + ... | test.cpp:359:14:359:32 | * ... |
148-
| test.cpp:357:24:357:30 | ... + ... | test.cpp:359:14:359:32 | * ... |
149142
| test.cpp:377:14:377:27 | new[] | test.cpp:378:15:378:23 | ... + ... |
150143
| test.cpp:377:14:377:27 | new[] | test.cpp:378:15:378:23 | ... + ... |
151-
| test.cpp:377:14:377:27 | new[] | test.cpp:381:5:381:9 | ... ++ |
152-
| test.cpp:377:14:377:27 | new[] | test.cpp:381:5:381:9 | ... ++ |
153144
| test.cpp:377:14:377:27 | new[] | test.cpp:384:13:384:16 | * ... |
154145
| test.cpp:378:15:378:23 | ... + ... | test.cpp:378:15:378:23 | ... + ... |
155146
| test.cpp:378:15:378:23 | ... + ... | test.cpp:384:13:384:16 | * ... |
156147
| test.cpp:378:15:378:23 | ... + ... | test.cpp:384:13:384:16 | * ... |
157-
| test.cpp:381:5:381:9 | ... ++ | test.cpp:381:5:381:9 | ... ++ |
158-
| test.cpp:381:5:381:9 | ... ++ | test.cpp:384:13:384:16 | * ... |
159148
| test.cpp:410:14:410:27 | new[] | test.cpp:411:15:411:23 | & ... |
160149
| test.cpp:410:14:410:27 | new[] | test.cpp:411:15:411:23 | & ... |
161-
| test.cpp:410:14:410:27 | new[] | test.cpp:413:5:413:8 | ... ++ |
162-
| test.cpp:410:14:410:27 | new[] | test.cpp:413:5:413:8 | ... ++ |
163150
| test.cpp:410:14:410:27 | new[] | test.cpp:415:7:415:15 | ... = ... |
164151
| test.cpp:411:15:411:23 | & ... | test.cpp:411:15:411:23 | & ... |
165152
| test.cpp:411:15:411:23 | & ... | test.cpp:415:7:415:15 | ... = ... |
166153
| test.cpp:411:15:411:23 | & ... | test.cpp:415:7:415:15 | ... = ... |
167-
| test.cpp:413:5:413:8 | ... ++ | test.cpp:413:5:413:8 | ... ++ |
168-
| test.cpp:413:5:413:8 | ... ++ | test.cpp:415:7:415:15 | ... = ... |
169-
| test.cpp:413:5:413:8 | ... ++ | test.cpp:415:7:415:15 | ... = ... |
170154
| test.cpp:421:14:421:27 | new[] | test.cpp:422:15:422:23 | & ... |
171155
| test.cpp:421:14:421:27 | new[] | test.cpp:422:15:422:23 | & ... |
172-
| test.cpp:421:14:421:27 | new[] | test.cpp:424:5:424:8 | ... ++ |
173-
| test.cpp:421:14:421:27 | new[] | test.cpp:424:5:424:8 | ... ++ |
174156
| test.cpp:421:14:421:27 | new[] | test.cpp:426:7:426:15 | ... = ... |
175157
| test.cpp:422:15:422:23 | & ... | test.cpp:422:15:422:23 | & ... |
176158
| test.cpp:422:15:422:23 | & ... | test.cpp:426:7:426:15 | ... = ... |
177159
| test.cpp:422:15:422:23 | & ... | test.cpp:426:7:426:15 | ... = ... |
178-
| test.cpp:424:5:424:8 | ... ++ | test.cpp:424:5:424:8 | ... ++ |
179-
| test.cpp:424:5:424:8 | ... ++ | test.cpp:426:7:426:15 | ... = ... |
180-
| test.cpp:424:5:424:8 | ... ++ | test.cpp:426:7:426:15 | ... = ... |
181160
| test.cpp:432:14:432:27 | new[] | test.cpp:433:15:433:23 | & ... |
182161
| test.cpp:432:14:432:27 | new[] | test.cpp:433:15:433:23 | & ... |
183-
| test.cpp:432:14:432:27 | new[] | test.cpp:436:5:436:8 | ... ++ |
184-
| test.cpp:432:14:432:27 | new[] | test.cpp:436:5:436:8 | ... ++ |
185162
| test.cpp:432:14:432:27 | new[] | test.cpp:438:7:438:15 | ... = ... |
186163
| test.cpp:433:15:433:23 | & ... | test.cpp:433:15:433:23 | & ... |
187164
| test.cpp:433:15:433:23 | & ... | test.cpp:438:7:438:15 | ... = ... |
188165
| test.cpp:433:15:433:23 | & ... | test.cpp:438:7:438:15 | ... = ... |
189-
| test.cpp:436:5:436:8 | ... ++ | test.cpp:436:5:436:8 | ... ++ |
190-
| test.cpp:436:5:436:8 | ... ++ | test.cpp:438:7:438:15 | ... = ... |
191-
| test.cpp:436:5:436:8 | ... ++ | test.cpp:438:7:438:15 | ... = ... |
192166
| test.cpp:444:14:444:27 | new[] | test.cpp:445:15:445:23 | & ... |
193167
| test.cpp:444:14:444:27 | new[] | test.cpp:445:15:445:23 | & ... |
194-
| test.cpp:444:14:444:27 | new[] | test.cpp:448:5:448:8 | ... ++ |
195-
| test.cpp:444:14:444:27 | new[] | test.cpp:448:5:448:8 | ... ++ |
196168
| test.cpp:444:14:444:27 | new[] | test.cpp:450:7:450:15 | ... = ... |
197169
| test.cpp:445:15:445:23 | & ... | test.cpp:445:15:445:23 | & ... |
198170
| test.cpp:445:15:445:23 | & ... | test.cpp:450:7:450:15 | ... = ... |
199171
| test.cpp:445:15:445:23 | & ... | test.cpp:450:7:450:15 | ... = ... |
200-
| test.cpp:448:5:448:8 | ... ++ | test.cpp:448:5:448:8 | ... ++ |
201-
| test.cpp:448:5:448:8 | ... ++ | test.cpp:450:7:450:15 | ... = ... |
202-
| test.cpp:448:5:448:8 | ... ++ | test.cpp:450:7:450:15 | ... = ... |
203172
| test.cpp:480:14:480:27 | new[] | test.cpp:481:15:481:23 | & ... |
204173
| test.cpp:480:14:480:27 | new[] | test.cpp:481:15:481:23 | & ... |
205-
| test.cpp:480:14:480:27 | new[] | test.cpp:484:5:484:8 | ... ++ |
206-
| test.cpp:480:14:480:27 | new[] | test.cpp:484:5:484:8 | ... ++ |
207174
| test.cpp:480:14:480:27 | new[] | test.cpp:486:7:486:15 | ... = ... |
208175
| test.cpp:481:15:481:23 | & ... | test.cpp:481:15:481:23 | & ... |
209176
| test.cpp:481:15:481:23 | & ... | test.cpp:486:7:486:15 | ... = ... |
210177
| test.cpp:481:15:481:23 | & ... | test.cpp:486:7:486:15 | ... = ... |
211-
| test.cpp:484:5:484:8 | ... ++ | test.cpp:484:5:484:8 | ... ++ |
212-
| test.cpp:484:5:484:8 | ... ++ | test.cpp:486:7:486:15 | ... = ... |
213-
| test.cpp:484:5:484:8 | ... ++ | test.cpp:486:7:486:15 | ... = ... |
214178
| test.cpp:543:14:543:27 | new[] | test.cpp:548:5:548:19 | ... = ... |
215179
| test.cpp:554:14:554:27 | new[] | test.cpp:559:5:559:19 | ... = ... |
216180
| test.cpp:642:14:642:31 | new[] | test.cpp:647:5:647:19 | ... = ... |
217-
| test.cpp:652:14:652:27 | new[] | test.cpp:656:3:656:6 | ... ++ |
218-
| test.cpp:652:14:652:27 | new[] | test.cpp:656:3:656:6 | ... ++ |
219-
| test.cpp:652:14:652:27 | new[] | test.cpp:662:3:662:11 | ... = ... |
220-
| test.cpp:656:3:656:6 | ... ++ | test.cpp:656:3:656:6 | ... ++ |
221-
| test.cpp:656:3:656:6 | ... ++ | test.cpp:662:3:662:11 | ... = ... |
222-
| test.cpp:656:3:656:6 | ... ++ | test.cpp:662:3:662:11 | ... = ... |
223181
| test.cpp:667:14:667:31 | new[] | test.cpp:675:7:675:23 | ... = ... |
224-
| test.cpp:695:13:695:26 | new[] | test.cpp:698:5:698:10 | ... += ... |
225-
| test.cpp:698:5:698:10 | ... += ... | test.cpp:701:15:701:16 | * ... |
226182
nodes
227183
| test.cpp:4:15:4:20 | call to malloc | semmle.label | call to malloc |
228184
| test.cpp:5:15:5:22 | ... + ... | semmle.label | ... + ... |
@@ -320,61 +276,40 @@ nodes
320276
| test.cpp:355:14:355:27 | new[] | semmle.label | new[] |
321277
| test.cpp:356:15:356:23 | ... + ... | semmle.label | ... + ... |
322278
| test.cpp:356:15:356:23 | ... + ... | semmle.label | ... + ... |
323-
| test.cpp:357:24:357:30 | ... + ... | semmle.label | ... + ... |
324-
| test.cpp:357:24:357:30 | ... + ... | semmle.label | ... + ... |
325279
| test.cpp:358:14:358:26 | * ... | semmle.label | * ... |
326280
| test.cpp:359:14:359:32 | * ... | semmle.label | * ... |
327281
| test.cpp:377:14:377:27 | new[] | semmle.label | new[] |
328282
| test.cpp:378:15:378:23 | ... + ... | semmle.label | ... + ... |
329283
| test.cpp:378:15:378:23 | ... + ... | semmle.label | ... + ... |
330-
| test.cpp:381:5:381:9 | ... ++ | semmle.label | ... ++ |
331-
| test.cpp:381:5:381:9 | ... ++ | semmle.label | ... ++ |
332284
| test.cpp:384:13:384:16 | * ... | semmle.label | * ... |
333285
| test.cpp:410:14:410:27 | new[] | semmle.label | new[] |
334286
| test.cpp:411:15:411:23 | & ... | semmle.label | & ... |
335287
| test.cpp:411:15:411:23 | & ... | semmle.label | & ... |
336-
| test.cpp:413:5:413:8 | ... ++ | semmle.label | ... ++ |
337-
| test.cpp:413:5:413:8 | ... ++ | semmle.label | ... ++ |
338288
| test.cpp:415:7:415:15 | ... = ... | semmle.label | ... = ... |
339289
| test.cpp:421:14:421:27 | new[] | semmle.label | new[] |
340290
| test.cpp:422:15:422:23 | & ... | semmle.label | & ... |
341291
| test.cpp:422:15:422:23 | & ... | semmle.label | & ... |
342-
| test.cpp:424:5:424:8 | ... ++ | semmle.label | ... ++ |
343-
| test.cpp:424:5:424:8 | ... ++ | semmle.label | ... ++ |
344292
| test.cpp:426:7:426:15 | ... = ... | semmle.label | ... = ... |
345293
| test.cpp:432:14:432:27 | new[] | semmle.label | new[] |
346294
| test.cpp:433:15:433:23 | & ... | semmle.label | & ... |
347295
| test.cpp:433:15:433:23 | & ... | semmle.label | & ... |
348-
| test.cpp:436:5:436:8 | ... ++ | semmle.label | ... ++ |
349-
| test.cpp:436:5:436:8 | ... ++ | semmle.label | ... ++ |
350296
| test.cpp:438:7:438:15 | ... = ... | semmle.label | ... = ... |
351297
| test.cpp:444:14:444:27 | new[] | semmle.label | new[] |
352298
| test.cpp:445:15:445:23 | & ... | semmle.label | & ... |
353299
| test.cpp:445:15:445:23 | & ... | semmle.label | & ... |
354-
| test.cpp:448:5:448:8 | ... ++ | semmle.label | ... ++ |
355-
| test.cpp:448:5:448:8 | ... ++ | semmle.label | ... ++ |
356300
| test.cpp:450:7:450:15 | ... = ... | semmle.label | ... = ... |
357301
| test.cpp:480:14:480:27 | new[] | semmle.label | new[] |
358302
| test.cpp:481:15:481:23 | & ... | semmle.label | & ... |
359303
| test.cpp:481:15:481:23 | & ... | semmle.label | & ... |
360-
| test.cpp:484:5:484:8 | ... ++ | semmle.label | ... ++ |
361-
| test.cpp:484:5:484:8 | ... ++ | semmle.label | ... ++ |
362304
| test.cpp:486:7:486:15 | ... = ... | semmle.label | ... = ... |
363305
| test.cpp:543:14:543:27 | new[] | semmle.label | new[] |
364306
| test.cpp:548:5:548:19 | ... = ... | semmle.label | ... = ... |
365307
| test.cpp:554:14:554:27 | new[] | semmle.label | new[] |
366308
| test.cpp:559:5:559:19 | ... = ... | semmle.label | ... = ... |
367309
| test.cpp:642:14:642:31 | new[] | semmle.label | new[] |
368310
| test.cpp:647:5:647:19 | ... = ... | semmle.label | ... = ... |
369-
| test.cpp:652:14:652:27 | new[] | semmle.label | new[] |
370-
| test.cpp:656:3:656:6 | ... ++ | semmle.label | ... ++ |
371-
| test.cpp:656:3:656:6 | ... ++ | semmle.label | ... ++ |
372-
| test.cpp:662:3:662:11 | ... = ... | semmle.label | ... = ... |
373311
| test.cpp:667:14:667:31 | new[] | semmle.label | new[] |
374312
| test.cpp:675:7:675:23 | ... = ... | semmle.label | ... = ... |
375-
| test.cpp:695:13:695:26 | new[] | semmle.label | new[] |
376-
| test.cpp:698:5:698:10 | ... += ... | semmle.label | ... += ... |
377-
| test.cpp:701:15:701:16 | * ... | semmle.label | * ... |
378313
subpaths
379314
#select
380315
| test.cpp:6:14:6:15 | * ... | test.cpp:4:15:4:20 | call to malloc | test.cpp:6:14:6:15 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:4:15:4:20 | call to malloc | call to malloc | test.cpp:5:19:5:22 | size | size |
@@ -408,6 +343,4 @@ subpaths
408343
| test.cpp:548:5:548:19 | ... = ... | test.cpp:543:14:543:27 | new[] | test.cpp:548:5:548:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:543:14:543:27 | new[] | new[] | test.cpp:548:8:548:14 | src_pos | src_pos |
409344
| test.cpp:559:5:559:19 | ... = ... | test.cpp:554:14:554:27 | new[] | test.cpp:559:5:559:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:554:14:554:27 | new[] | new[] | test.cpp:559:8:559:14 | src_pos | src_pos |
410345
| test.cpp:647:5:647:19 | ... = ... | test.cpp:642:14:642:31 | new[] | test.cpp:647:5:647:19 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:642:14:642:31 | new[] | new[] | test.cpp:647:8:647:14 | src_pos | src_pos |
411-
| test.cpp:662:3:662:11 | ... = ... | test.cpp:652:14:652:27 | new[] | test.cpp:662:3:662:11 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@ + 1. | test.cpp:652:14:652:27 | new[] | new[] | test.cpp:653:19:653:22 | size | size |
412346
| test.cpp:675:7:675:23 | ... = ... | test.cpp:667:14:667:31 | new[] | test.cpp:675:7:675:23 | ... = ... | This write might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:667:14:667:31 | new[] | new[] | test.cpp:675:10:675:18 | ... ++ | ... ++ |
413-
| test.cpp:701:15:701:16 | * ... | test.cpp:695:13:695:26 | new[] | test.cpp:701:15:701:16 | * ... | This read might be out of bounds, as the pointer might be equal to $@ + $@. | test.cpp:695:13:695:26 | new[] | new[] | test.cpp:696:19:696:22 | size | size |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/pointer-deref/test.cpp

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ void test2(int size) {
1717
char* q = p + size - 1; // $ alloc=L16
1818
char a = *q; // GOOD
1919
char b = *(q - 1); // GOOD
20-
char c = *(q + 1); // $ deref=L20 // BAD
20+
char c = *(q + 1); // $ deref=L17->L20 // BAD
2121
char d = *(q + size); // BAD [NOT DETECTED]
2222
char e = *(q - size); // GOOD
2323
char f = *(q + size + 1); // BAD [NOT DETECTED]
@@ -198,7 +198,7 @@ void test12(unsigned len, unsigned index) {
198198
return;
199199
}
200200

201-
p[index] = '\0'; // $ deref=L201 // BAD
201+
p[index] = '\0'; // $ deref=L195->L201 deref=L197->L201 // BAD
202202
}
203203

204204
void test13(unsigned len, unsigned index) {
@@ -210,7 +210,7 @@ void test13(unsigned len, unsigned index) {
210210
return;
211211
}
212212

213-
*q = '\0'; // $ deref=L213 // BAD
213+
*q = '\0'; // $ deref=L206->L213 deref=L209->L213 // BAD
214214
}
215215

216216
bool unknown();
@@ -261,7 +261,7 @@ void test17(unsigned len)
261261
int *end = xs + len; // $ alloc=L260
262262
for (int *x = xs; x <= end; x++)
263263
{
264-
int i = *x; // $ deref=L264 // BAD
264+
int i = *x; // $ deref=L261->L264 deref=L262->L264 // BAD
265265
}
266266
}
267267

@@ -271,7 +271,7 @@ void test18(unsigned len)
271271
int *end = xs + len; // $ alloc=L270
272272
for (int *x = xs; x <= end; x++)
273273
{
274-
*x = 0; // $ deref=L274 // BAD
274+
*x = 0; // $ deref=L271->L274 deref=L272->L274 // BAD
275275
}
276276
}
277277

@@ -355,8 +355,8 @@ void test25(unsigned size) {
355355
char *xs = new char[size];
356356
char *end = xs + size; // $ alloc=L355
357357
char *end_plus_one = end + 1;
358-
int val1 = *end_plus_one; // $ deref=L358+1 // BAD
359-
int val2 = *(end_plus_one + 1); // $ deref=L359+2 // BAD
358+
int val1 = *end_plus_one; // $ deref=L356->L358+1 deref=L357->L358+1 // BAD
359+
int val2 = *(end_plus_one + 1); // $ deref=L356->L359+2 deref=L357->L359+2 // BAD
360360
}
361361

362362
void test26(unsigned size) {
@@ -381,7 +381,7 @@ void test27(unsigned size, bool b) {
381381
end++;
382382
}
383383

384-
int val = *end; // $ deref=L384+1 // BAD
384+
int val = *end; // $ deref=L378->L384+1 deref=L381->L384+1 // BAD
385385
}
386386

387387
void test28(unsigned size) {
@@ -412,7 +412,7 @@ void test28_simple2(unsigned size) {
412412
if (xs < end) {
413413
xs++;
414414
if (xs < end + 1) {
415-
xs[0] = 0; // $ deref=L415 // BAD
415+
xs[0] = 0; // $ deref=L411->L415 deref=L412->L415 deref=L414->L415 // BAD
416416
}
417417
}
418418
}
@@ -423,7 +423,7 @@ void test28_simple3(unsigned size) {
423423
if (xs < end) {
424424
xs++;
425425
if (xs - 1 < end) {
426-
xs[0] = 0; // $ deref=L426 // BAD
426+
xs[0] = 0; // $ deref=L422->L426 deref=L423->L426 deref=L425->L426 // BAD
427427
}
428428
}
429429
}
@@ -435,7 +435,7 @@ void test28_simple4(unsigned size) {
435435
end++;
436436
xs++;
437437
if (xs < end) {
438-
xs[0] = 0; // $ deref=L438 // BAD
438+
xs[0] = 0; // $ deref=L433->L438 deref=L434->L438 deref=L435->L438 // BAD
439439
}
440440
}
441441
}
@@ -447,7 +447,7 @@ void test28_simple5(unsigned size) {
447447
if (xs < end) {
448448
xs++;
449449
if (xs < end) {
450-
xs[0] = 0; // $ deref=L450 // BAD
450+
xs[0] = 0; // $ deref=L445->L450 deref=L446->L450 // BAD
451451
}
452452
}
453453
}
@@ -483,7 +483,7 @@ void test28_simple8(unsigned size) {
483483
if (xs < end) {
484484
xs++;
485485
if (xs < end - 1) {
486-
xs[0] = 0; // $ deref=L486+498 // BAD
486+
xs[0] = 0; // $ deref=L481->L486+498 deref=L482->L486+498 // BAD
487487
}
488488
}
489489
}
@@ -659,7 +659,7 @@ void test32(unsigned size) {
659659
xs++;
660660
if (xs >= end)
661661
return;
662-
xs[0] = 0; // $ deref=L656->L662+1 deref=L657->L662+1 GOOD [FALSE POSITIVE]
662+
xs[0] = 0; // $ GOOD
663663
}
664664

665665
void test33(unsigned size, unsigned src_pos)
@@ -698,6 +698,6 @@ void test34(unsigned size) {
698698
p += 1;
699699
}
700700
if (p + 1 < end) {
701-
int val = *p; // $ deref=L698->L700->L701 // GOOD [FALSE POSITIVE]
701+
int val = *p; // GOOD
702702
}
703703
}

0 commit comments

Comments
 (0)