[DIFF-INFORMED] Go: AllocationSizeOverflow

d10c · d10c · commit e0d16a863bb7 · 2025-07-17T11:46:29.000+02:00
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/Security/CWE-190/AllocationSizeOverflow.ql#L24
diff --git a/go/ql/lib/semmle/go/security/AllocationSizeOverflow.qll b/go/ql/lib/semmle/go/security/AllocationSizeOverflow.qll
@@ -56,6 +56,17 @@ module AllocationSizeOverflow {
         succ = c
       )
     }
+
+    predicate observeDiffInformedIncrementalMode() { any() }
+
+    Location getASelectedSinkLocation(DataFlow::Node sink) {
+      result = sink.getLocation()
+      or
+      exists(DataFlow::Node allocsz |
+        isSinkWithAllocationSize(sink, allocsz) and
+        result = allocsz.getLocation()
+      )
+    }
   }
 
   /** Tracks taint flow to find allocation-size overflows. */

Original file line number	Diff line number	Diff line change
`@@ -56,6 +56,17 @@ module AllocationSizeOverflow {`
`56`	`56`	`succ = c`
`57`	`57`	`)`
`58`	`58`	`}`
	`59`	`+`
	`60`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
	`61`	`+`
	`62`	`+ Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`63`	`+ result = sink.getLocation()`
	`64`	`+ or`
	`65`	`+ exists(DataFlow::Node allocsz \|`
	`66`	`+ isSinkWithAllocationSize(sink, allocsz) and`
	`67`	`+ result = allocsz.getLocation()`
	`68`	`+ )`
	`69`	`+ }`
`59`	`70`	`}`
`60`	`71`
`61`	`72`	`/** Tracks taint flow to find allocation-size overflows. */`