C++: constrain indirect out node to constructors

2026-04-28 18:25:24 +02:00 · 2022-10-27 11:48:17 -04:00
parent 25a1148e04
commit 24cb36a1e2
2 changed files with 102 additions and 101 deletions
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
@@ -740,6 +740,7 @@ private predicate exprNodeShouldBeIndirectOperand(IndirectOperand node, Expr e,

 private predicate exprNodeShouldBeIndirectOutNode(IndirectArgumentOutNode node, Expr e) {
  exists(CallInstruction call |
+    call.getStaticCallTarget() instanceof Constructor and
    e = call.getConvertedResultExpression() and
    call.getThisArgumentOperand() = node.getAddressOperand()
  )