Update cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll

MathiasVP · jketema · web-flow · commit c26511307321 · 2023-08-14T09:51:28.000+01:00
Co-authored-by: Jeroen Ketema &lt;93738568+jketema@users.noreply.github.com&gt;
diff --git a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll
@@ -114,11 +114,11 @@ private module InvalidPointerToDerefBarrier {
   private predicate operandGuardChecks(
     PointerArithmeticInstruction pai, IRGuardCondition g, Operand small, int k, boolean edge
   ) {
-    exists(DataFlow::Node source, DataFlow::Node nSmall, DataFlow::Node nBig |
+    exists(DataFlow::Node source, DataFlow::Node nSmall, DataFlow::Node nLarge |
       nSmall.asOperand() = small and
       BarrierConfig::isSource(source, pai) and
-      BarrierFlow::flow(source, nBig) and
-      BarrierConfig::isSink(nSmall, nBig, g, k, edge)
+      BarrierFlow::flow(source, nLarge) and
+      BarrierConfig::isSink(nSmall, nLarge, g, k, edge)
     )
   }
 

Original file line number	Diff line number	Diff line change
`@@ -114,11 +114,11 @@ private module InvalidPointerToDerefBarrier {`
`114`	`114`	`private predicate operandGuardChecks(`
`115`	`115`	`PointerArithmeticInstruction pai, IRGuardCondition g, Operand small, int k, boolean edge`
`116`	`116`	`) {`
`117`		`- exists(DataFlow::Node source, DataFlow::Node nSmall, DataFlow::Node nBig \|`
	`117`	`+ exists(DataFlow::Node source, DataFlow::Node nSmall, DataFlow::Node nLarge \|`
`118`	`118`	`nSmall.asOperand() = small and`
`119`	`119`	`BarrierConfig::isSource(source, pai) and`
`120`		`- BarrierFlow::flow(source, nBig) and`
`121`		`- BarrierConfig::isSink(nSmall, nBig, g, k, edge)`
	`120`	`+ BarrierFlow::flow(source, nLarge) and`
	`121`	`+ BarrierConfig::isSink(nSmall, nLarge, g, k, edge)`
`122`	`122`	`)`
`123`	`123`	`}`
`124`	`124`