diff --git a/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll b/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll index 5dfeb8f3137..e641e50532f 100644 --- a/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll +++ b/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll @@ -81,30 +81,32 @@ private int getSize(VariableAccess va) { not v instanceof Field and result = getVariableSize(v) or - exists(Class c, int trueSize | - // Otherwise, we find the "outermost" object and compute the size - // as the difference between the size of the type of the "outermost - // object" and the offset of the field relative to that type. - // For example, consider the following structs: - // ``` - // struct S { - // uint32_t x; - // uint32_t y; - // }; - // struct S2 { - // S s; - // uint32_t z; - // }; - // ``` - // Given an object `S2 s2` the size of the buffer `&s2.s.y` - // is the size of the base object type (i.e., `S2`) minutes the offset - // of `y` relative to the type `S2` (i.e., `4`). So the size of the - // buffer is `12 - 4 = 8`. - c = getRootType(va) and - // we calculate the size based on the last field, to avoid including any padding after it - trueSize = max(Field f | | f.getOffsetInClass(c) + getVariableSize(f)) and - result = trueSize - v.(Field).getOffsetInClass(c) - ) + result = + unique(Class c, int trueSize | + // Otherwise, we find the "outermost" object and compute the size + // as the difference between the size of the type of the "outermost + // object" and the offset of the field relative to that type. + // For example, consider the following structs: + // ``` + // struct S { + // uint32_t x; + // uint32_t y; + // }; + // struct S2 { + // S s; + // uint32_t z; + // }; + // ``` + // Given an object `S2 s2` the size of the buffer `&s2.s.y` + // is the size of the base object type (i.e., `S2`) minutes the offset + // of `y` relative to the type `S2` (i.e., `4`). So the size of the + // buffer is `12 - 4 = 8`. + c = getRootType(va) and + // we calculate the size based on the last field, to avoid including any padding after it + trueSize = max(Field f | | f.getOffsetInClass(c) + getVariableSize(f)) + | + trueSize - v.(Field).getOffsetInClass(c) + ) ) }