Update cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll

MathiasVP · jketema · web-flow · commit db8b50610650 · 2023-07-24T14:58:06.000+02:00
Co-authored-by: Jeroen Ketema &lt;93738568+jketema@users.noreply.github.com&gt;
diff --git a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/AllocationToInvalidPointer.qll
@@ -16,7 +16,7 @@
  * `(allocation, size of allocation)` to a pair `(a, b)` where there exists a pointer-arithmetic instruction
  * `pai = a + r` such that `b` is a dataflow node where `b <= r`. Because there will be a dataflow-path from
  * `allocation` to `a` this means that the `pai` will compute a pointer that is some number of elements beyond
- * the end position in the allocation. See `pointerAddInstructionHasBounds` for the implementation of this.
+ * the end position of the allocation. See `pointerAddInstructionHasBounds` for the implementation of this.
  *
  * In the above example, the pair `(a, b)` is `(base, size)` with `base` and `size` coming from the expression
  * `base + size` on line 2, which is also the pointer-arithmetic instruction. In general, the pair does not necessarily

Original file line number	Diff line number	Diff line change
`@@ -16,7 +16,7 @@`
`16`	`16`	* `(allocation, size of allocation)` to a pair `(a, b)` where there exists a pointer-arithmetic instruction
`17`	`17`	* `pai = a + r` such that `b` is a dataflow node where `b <= r`. Because there will be a dataflow-path from
`18`	`18`	* `allocation` to `a` this means that the `pai` will compute a pointer that is some number of elements beyond
`19`		- * the end position in the allocation. See `pointerAddInstructionHasBounds` for the implementation of this.
	`19`	+ * the end position of the allocation. See `pointerAddInstructionHasBounds` for the implementation of this.
`20`	`20`	`*`
`21`	`21`	* In the above example, the pair `(a, b)` is `(base, size)` with `base` and `size` coming from the expression
`22`	`22`	* `base + size` on line 2, which is also the pointer-arithmetic instruction. In general, the pair does not necessarily