From 73b93be3130d9fe308b8b1c41786fb83e2bb0220 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Wed, 14 Dec 2022 12:33:17 +0000 Subject: [PATCH] C++: Prevent non-termination in 'getTypeImpl' when a iterator defines itself as 'value_type'. --- .../code/cpp/ir/dataflow/internal/DataFlowUtil.qll | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll index 6c949a024bb..14810e51fcd 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll @@ -670,7 +670,15 @@ private Type getTypeImpl(Type t, int indirectionIndex) { result = t or indirectionIndex > 0 and - result = getTypeImpl(stripPointer(t), indirectionIndex - 1) + exists(Type stripped | + stripped = stripPointer(t) and + // We need to avoid the case where `stripPointer(t) = t` (which can happen on + // iterators that specify a `value_type` that is the iterator itself). Such a type + // would create an infinite loop otherwise. For these cases we simply don't produce + // a result for `getType`. + stripped.getUnspecifiedType() != t.getUnspecifiedType() and + result = getTypeImpl(stripPointer(t), indirectionIndex - 1) + ) } /**