source predicate

trivial.ql

@@ -0,0 +1,39 @@
+import cpp
+
+// 1. source: count = read(STDIN_FILENO, buf, BUFSIZE);
+// want buf
+// from VariableAccess buf, FunctionCall read
+// where read.getArgument(1) = buf and
+// read.getTarget().getName() = "read"
+// select read, buf
+// predicate findBuf(VariableAccess buf, FunctionCall read) {
+//     read.getArgument(1) = buf and
+//     read.getTarget().getName() = "read"
+// }
+// from VariableAccess buf, FunctionCall read
+// where findBuf(buf, read)
+// select read, buf
+// predicate findBuf(VariableAccess buf) {
+//     exists(FunctionCall read |
+//     read.getArgument(1) = buf and
+//     read.getTarget().getName() = "read"
+//     )
+// }
+// from VariableAccess buf
+// where findBuf(buf)
+// select buf
+
+class FindBuf extends VariableAccess {
+  FindBuf() {
+    exists(FunctionCall read |
+      read.getArgument(1) = this and
+      read.getTarget().getName() = "read"
+    )
+  }
+}
+
+from FindBuf buf
+select buf
+
+// 2. sink:  rc = sqlite3_exec(db, query, NULL, 0, &zErrMsg);
+// 3. dataflow between them