C++: DecompressionBombs

d10c · d10c · commit 2bbebf51aa0a · 2025-07-11T14:42:57.000+02:00
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-409/DecompressionBombs.ql b/cpp/ql/src/experimental/Security/CWE/CWE-409/DecompressionBombs.ql
@@ -29,8 +29,12 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {
     any(DecompressionFlowStep s).isAdditionalFlowStep(node1, node2)
   }
 
-  predicate observeDiffInformedIncrementalMode() {
-    any() // TODO: Make sure that the location overrides match the query's select clause: Column 5 does not select a source or sink originating from the flow call on line 38 (/Users/d10c/src/semmle-code/ql/cpp/ql/src/experimental/Security/CWE/CWE-409/DecompressionBombs.ql@39:87:39:88)
+  predicate observeDiffInformedIncrementalMode() { any() }
+
+  Location getASelectedSourceLocation(DataFlow::Node source) { none() }
+
+  Location getASelectedSinkLocation(DataFlow::Node sink) {
+    exists(FunctionCall fc | result = [sink.getLocation(), fc.getLocation()] | isSink(fc, sink))
   }
 }
 

Original file line number	Diff line number	Diff line change
`@@ -29,8 +29,12 @@ module DecompressionTaintConfig implements DataFlow::ConfigSig {`
`29`	`29`	`any(DecompressionFlowStep s).isAdditionalFlowStep(node1, node2)`
`30`	`30`	`}`
`31`	`31`
`32`		`- predicate observeDiffInformedIncrementalMode() {`
`33`		`- any() // TODO: Make sure that the location overrides match the query's select clause: Column 5 does not select a source or sink originating from the flow call on line 38 (/Users/d10c/src/semmle-code/ql/cpp/ql/src/experimental/Security/CWE/CWE-409/DecompressionBombs.ql@39:87:39:88)`
	`32`	`+ predicate observeDiffInformedIncrementalMode() { any() }`
	`33`	`+`
	`34`	`+ Location getASelectedSourceLocation(DataFlow::Node source) { none() }`
	`35`	`+`
	`36`	`+ Location getASelectedSinkLocation(DataFlow::Node sink) {`
	`37`	`+ exists(FunctionCall fc \| result = [sink.getLocation(), fc.getLocation()] \| isSink(fc, sink))`
`34`	`38`	`}`
`35`	`39`	`}`
`36`	`40`