From 0a6f914bfcbef3b147fa5817d33d24f995ac17cf Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 3 Feb 2023 14:09:01 +0000 Subject: [PATCH] C++: Make the documentation on 'isSink' less ambiguous. --- .../code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll index 272dfd04470..390144d2a77 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll @@ -515,7 +515,11 @@ private module Cached { private predicate isSink(Instruction instr, CallInstruction call) { getAUse(instr).(ArgumentOperand).getCall() = call and - // Don't include various operations that don't modify what the iterator points to. + // Only include operations that may modify the object that the iterator points to. + // The following is a non-exhaustive list of things that may modify the value of the + // iterator, but never the value of what the iterator points to. + // The more things we can exclude here, the faster the small dataflow-like analysis + // done by `convertsIntoArgument` will converge. not exists(Function f | f = call.getStaticCallTarget() | f instanceof Iterator::IteratorCrementOperator or f instanceof Iterator::IteratorBinaryArithmeticOperator or