Skip to content

Commit 5e701b5

Browse files
committed
Convert BasicStringMayNotBeNullTerminated to the new dataflow library
1 parent 99b45ad commit 5e701b5

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

cpp/common/src/codingstandards/cpp/rules/basicstringmaynotbenullterminated/BasicStringMayNotBeNullTerminated.qll

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import codingstandards.cpp.Customizations
88
import codingstandards.cpp.Exclusions
99
import semmle.code.cpp.security.BufferWrite
1010
import semmle.code.cpp.commons.Buffer
11-
import semmle.code.cpp.dataflow.TaintTracking
11+
import semmle.code.cpp.dataflow.new.TaintTracking
1212
import codingstandards.cpp.PossiblyUnsafeStringOperation
1313

1414
abstract class BasicStringMayNotBeNullTerminatedSharedQuery extends Query { }
@@ -39,8 +39,13 @@ query predicate problems(BasicStringConstructorCall cc, string message) {
3939
// a) is not a string literal
4040
not arg instanceof StringLiteral and
4141
// b) may exist in a dataflow from an unsafe usage of a string function
42-
exists(PossiblyUnsafeStringOperation op |
43-
TaintTracking::localTaint(DataFlow::exprNode(op.getAnArgument()), DataFlow::exprNode(arg))
42+
exists(
43+
PossiblyUnsafeStringOperation op, DataFlow::DefinitionByReferenceNode opNode,
44+
DataFlow::Node argNode
45+
|
46+
opNode.asDefiningArgument() = op.getAnArgument() and argNode.asIndirectExpr() = arg
47+
|
48+
TaintTracking::localTaint(opNode, argNode)
4449
) and
4550
message = "Construction of string object with possibly non-null terminated C-style string."
4651
)

0 commit comments

Comments
 (0)