Update cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll

MathiasVP · jketema · web-flow · commit e1763db36c2d · 2023-07-25T10:31:37.000+02:00
Co-authored-by: Jeroen Ketema &lt;93738568+jketema@users.noreply.github.com&gt;
diff --git a/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll b/cpp/ql/lib/semmle/code/cpp/security/InvalidPointerDereference/InvalidPointerToDereference.qll
@@ -60,7 +60,7 @@
  * range analysis then infers that the address operand of `*p` (i.e., `p`) is non-strictly upper bounded by `p`, and thus reports
  * an alert on line 7.
  *
- * In order to handle this false positive, we define a barrier that identifies guards such as `p < end` that ensures that a value
+ * In order to handle the above false positive, we define a barrier that identifies guards such as `p < end` that ensures that a value
  * is less than the pointer-arithmetic instruction that computed the invalid pointer. This is done in the `InvalidPointerToDerefBarrier`
  * module. Since the node we're tracking isn't necessarily _equal_ to the pointer-arithmetic instruction, but rather satisfies
  * `node.asInstruction() <= pai + delta`, we need to account for the delta when checking if a guard is sufficiently strong to infer

Original file line number	Diff line number	Diff line change
`@@ -60,7 +60,7 @@`
`60`	`60`	* range analysis then infers that the address operand of `*p` (i.e., `p`) is non-strictly upper bounded by `p`, and thus reports
`61`	`61`	`* an alert on line 7.`
`62`	`62`	`*`
`63`		- * In order to handle this false positive, we define a barrier that identifies guards such as `p < end` that ensures that a value
	`63`	+ * In order to handle the above false positive, we define a barrier that identifies guards such as `p < end` that ensures that a value
`64`	`64`	* is less than the pointer-arithmetic instruction that computed the invalid pointer. This is done in the `InvalidPointerToDerefBarrier`
`65`	`65`	`* module. Since the node we're tracking isn't necessarily _equal_ to the pointer-arithmetic instruction, but rather satisfies`
`66`	`66`	* `node.asInstruction() <= pai + delta`, we need to account for the delta when checking if a guard is sufficiently strong to infer