hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 11:15:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: prevent a bad join order

Browse Source
This commit is contained in:
Robert Marsh
2022-09-07 13:46:26 -04:00
committed by Mathias Vorreiter Pedersen
parent 7f6b400b78
commit 61017a7997
1 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql
View File

@@ -24,11 +24,8 @@ class ArraySizeConfiguration extends ProductFlow::Configuration {
}
override predicate isSinkPair(DataFlow::Node sink1, DataFlow::Node sink2) {
exists(PointerAddInstruction pai, Instruction index, Bound b, int delta |
pai.getRight() = index and
pai.getLeft() = sink1.asInstruction() and
bounded(index, b, delta, true) and
sink2.asInstruction() = b.getInstruction() and
exists(PointerAddInstruction pai, int delta |
isSinkPair1(sink1, sink2, pai, delta) and
(
delta = 0 and
exists(DataFlow::Node paiNode, DataFlow::Node derefNode |
@@ -43,6 +40,18 @@ class ArraySizeConfiguration extends ProductFlow::Configuration {
}
}
pragma[nomagic]
predicate isSinkPair1(
DataFlow::Node sink1, DataFlow::Node sink2, PointerAddInstruction pai, int delta
) {
exists(Instruction index, ValueNumberBound b |
pai.getRight() = index and
pai.getLeft() = sink1.asInstruction() and
bounded(index, b, delta, true) and
sink2.asInstruction() = b.getInstruction()
)
}
from
ArraySizeConfiguration conf, DataFlow::PathNode source1, DataFlow2::PathNode source2,
DataFlow::PathNode sink1, DataFlow2::PathNode sink2