how to filter out this situation？

Hi, I have been learning to use CodeQL recently. I was trying to find all expressions that reach the `len` parameter of `memcpy`, and in the results, there is a case like the following.

```c
attr->val.octets = _malloc(attr->length);
if (!attr->val.octets)
goto out_err_mem;
memcpy(attr->val.octets, orig_avp_val, attr->length);
```
In this part, the `len` parameter of `memcpy` is exactly the same as the parameter of `_malloc`, which I consider to be safe. Therefore, I would like to exclude this situation. However, first, I want to identify this pattern, so I have written the following code.

```ql
import cpp
import semmle.code.cpp.dataflow.new.DataFlow
import semmle.code.cpp.dataflow.new.TaintTracking

// class MallocSize extends Expr {
// MallocSize() {
// exists(FunctionCall fc |
// fc.getTarget().hasName("malloc") and
// this = fc.getArgument(0)
// )
// }
// }

module RecvToMemcpyConfig implements DataFlow::ConfigSig {
predicate isSource(DataFlow::Node source) {
exists(Expr e | source.asExpr() = e
and not e.isConstant()
)
}

predicate isSink(DataFlow::Node sink) {
exists(FunctionCall fc, FunctionCall mc |
fc.getTarget().hasName("memcpy") and mc.getTarget().hasName("malloc")
and sink.asExpr() = fc.getArgument(2)
and fc.getArgument(2) = mc.getArgument(0)
)
and not sink.asExpr().isConstant()
}
}

module RecvToMemcpyFlow = TaintTracking::Global;

from RecvToMemcpyFlow::PathNode source, RecvToMemcpyFlow::PathNode sink
where RecvToMemcpyFlow::flowPath(source, sink)
select
source,
sink,
sink.getNode().getFunction().getFile(),
source.getNode().getFunction().getFile()
```

Although I think this code may not handle the following situation, I believe it should be able to handle the case where the `size` parameter of `malloc` and the `len` parameter of `memcpy` are exactly the same, meaning when the expressions are an exact match.

```c
b = _malloc(sizeof(*b) + size);
b->size = size;
memcpy(b->buf, buf, size);
```

But the result returns 0 results.

I also tried other approaches, but none of them met my expectations. How should I correctly handle this situation?

Start with the DataFlow and TaintTracking imports, then inspect RecvToMemcpyConfig, especially isSource, isSink, and the flowPath query. Reproduce the query against the two C examples and determine whether the intended exact-expression and related-expression cases are returned. Done means the query identifies the safe malloc/memcpy size relationships that the issue describes.

Escrito por el modelo de indexación a partir del texto del issue.