CodeQL library for C/C++
codeql/cpp-all 0.12.12-dev (changelog, source)
Search

Predicate pointerAddInstructionHasBounds

Holds if allocation flows to allocSink and allocSink represents the left operand of the pointer-arithmetic instruction pai = a + b (i.e., allocSink = a), and b <= allocation + delta.

Import path

import semmle.code.cpp.security.InvalidPointerDereference.AllocationToInvalidPointer
predicate pointerAddInstructionHasBounds(Node allocation, PointerAddInstruction pai, Node allocSink, int delta)