Predicate pointerAddInstructionHasBounds
Holds if allocation
flows to allocSink
and allocSink
represents the left operand
of the pointer-arithmetic instruction pai = a + b
(i.e., allocSink = a
), and
b <= allocation + delta
.
Import path
import semmle.code.cpp.security.InvalidPointerDereference.AllocationToInvalidPointer
predicate pointerAddInstructionHasBounds(Node allocation, PointerAddInstruction pai, Node allocSink, int delta)