Skip to content

Commit 5d5cd4f

Browse files
authored
Update AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql
1 parent f074564 commit 5d5cd4f

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

cpp/ql/src/experimental/Security/CWE/CWE-788/AccessOfMemoryLocationAfterEndOfBufferUsingStrncat.ql

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
import cpp
1414
import semmle.code.cpp.valuenumbering.HashCons
15+
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
1516

1617
/**
1718
* A call to `strncat` of the form `strncat(buff, str, someExpr - strlen(buf))`, for some expression `someExpr` equal to `sizeof(buff)`.
@@ -22,8 +23,8 @@ class WrongCallStrncat extends FunctionCall {
2223
WrongCallStrncat() {
2324
this.getTarget().hasGlobalOrStdName("strncat") and
2425
// the expression of the first argument in `strncat` and `strnlen` is identical
25-
hashCons(this.getArgument(0)) =
26-
hashCons(this.getArgument(2).(SubExpr).getRightOperand().(StrlenCall).getStringExpr()) and
26+
globalValueNumber(this.getArgument(0)) =
27+
globalValueNumber(this.getArgument(2).(SubExpr).getRightOperand().(StrlenCall).getStringExpr()) and
2728
// using a string constant often speaks of manually calculating the length of the required buffer.
2829
(
2930
not this.getArgument(1) instanceof StringLiteral and

0 commit comments

Comments
 (0)