We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent bcd84ef commit 1dd5926Copy full SHA for 1dd5926
cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -339,8 +339,8 @@ private Element adjustedSink(DataFlow::Node sink) {
339
// Taint `e--` and `e++` when `e` is tainted.
340
result.(PostfixCrementOperation).getAnOperand() = sink.asExpr()
341
or
342
- // Taint `e1 += e2` when `e1` or `e2` is tainted.
343
- result.(AssignArithmeticOperation).getAnOperand() = sink.asExpr()
+ // Taint `e1 += e2`, `e &= e2` and friends when `e1` or `e2` is tainted.
+ result.(AssignOperation).getAnOperand() = sink.asExpr()
344
}
345
346
predicate tainted(Expr source, Element tainted) {
0 commit comments