Skip to content

Commit c8be67c

Browse files
committed
C++: Generalize PostfixCrementOperation to CrementOperation to fix false negatives reported by Geoffrey
1 parent 1dd5926 commit c8be67c

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -336,8 +336,8 @@ private Element adjustedSink(DataFlow::Node sink) {
336336
// short-circuiting condition and thus might get skipped.
337337
result.(NotExpr).getOperand() = sink.asExpr()
338338
or
339-
// Taint `e--` and `e++` when `e` is tainted.
340-
result.(PostfixCrementOperation).getAnOperand() = sink.asExpr()
339+
// Taint postfix and prefix crement operations when their operand is tainted.
340+
result.(CrementOperation).getAnOperand() = sink.asExpr()
341341
or
342342
// Taint `e1 += e2`, `e &= e2` and friends when `e1` or `e2` is tainted.
343343
result.(AssignOperation).getAnOperand() = sink.asExpr()

0 commit comments

Comments
 (0)