C++: Use 'max' instead of 'unique.'

cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll

@@ -80,7 +80,7 @@ private predicate localFlowToExprStep(DataFlow::Node n1, DataFlow::Node n2) {
 
 /** Holds if `n2 + delta` may be equal to `n1`. */
 private predicate localFlowStepToExpr(Expr e1, Expr e2) {
-  getBufferSize0(e1) and
+  getBufferSizeCand0(e1) and
   exists(DataFlow::Node n1, DataFlow::Node mid, DataFlow::Node n2 |
     n1.asExpr() = e1 and
     localFlowToExprStep*(n1, mid) and
@@ -95,7 +95,7 @@ private predicate localFlowStepToExpr(Expr e1, Expr e2) {
  * expression.
  */
 private predicate step(Expr e1, Expr e2, int delta) {
-  getBufferSize0(e1) and
+  getBufferSizeCand0(e1) and
   exists(Variable bufferVar, Class parentClass, VariableAccess parentPtr, int bufferSize |
     e1 = parentPtr
   |
@@ -117,27 +117,37 @@ private predicate step(Expr e1, Expr e2, int delta) {
 }
 
 pragma[nomagic]
-private predicate getBufferSize0(Expr e) {
+private predicate getBufferSizeCand0(Expr e) {
   exists(isSource(e, _))
   or
   exists(Expr e0 |
-    getBufferSize0(e0) and
+    getBufferSizeCand0(e0) and
     step(e0, e, _)
   )
 }
 
+/**
+ * Get the size in bytes of the buffer pointed to by an expression (if this can be determined).
+ *
+ * NOTE: There can be multiple `(result, why)` for a given `bufferExpr`.
+ */
+private int getBufferSizeCand(Expr bufferExpr, Element why) {
+  getBufferSizeCand0(bufferExpr) and
+  (
+    result = isSource(bufferExpr, why)
+    or
+    exists(Expr e0, int delta, int size |
+      size = getBufferSizeCand(e0, why) and
+      step(e0, bufferExpr, delta) and
+      result = size + delta
+    )
+  )
+}
+
 /**
  * Get the size in bytes of the buffer pointed to by an expression (if this can be determined).
  */
 int getBufferSize(Expr bufferExpr, Element why) {
-  getBufferSize0(bufferExpr) and
-  (
-    result = isSource(bufferExpr, why)
-    or
-    exists(Expr e0, int delta, int size |
-      size = getBufferSize(e0, why) and
-      delta = unique(int cand | step(e0, bufferExpr, cand) | cand) and
-      result = size + delta
-    )
-  )
+  result = max( | | getBufferSizeCand(bufferExpr, _)) and
+  result = getBufferSizeCand(bufferExpr, why)
 }