CodeQL library for C/C++
Search

Predicate TaintedWithPath::subpaths

Holds if there is flow from arg to out across a call that can by summarized by the flow from par to ret within it, in the graph of data flow path explanations.

Import path

import semmle.code.cpp.ir.dataflow.DefaultTaintTracking
predicate subpaths(PathNode arg, PathNode par, PathNode ret, PathNode out)