C++: Fix the bug.

2026-04-28 02:05:14 +02:00 · 2025-02-27 21:24:07 +00:00
parent 51d916263d
commit 998bec1efb
5 changed files with 18 additions and 13 deletions
--- a/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll
+++ b/cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll
@@ -92,7 +92,12 @@ private int getSize(VariableAccess va) {
      // buffer is `12 - 4 = 8`.
      c = getRootType(va) and
      // we calculate the size based on the last field, to avoid including any padding after it
-      trueSize = max(Field f | f = c.getAField() | f.getOffsetInClass(c) + f.getUnspecifiedType().getSize()) and
+      trueSize =
+        max(Field f |
+          f.getDeclaringType*() = c
+        |
+          f.getOffsetInClass(c) + f.getUnspecifiedType().getSize()
+        ) and
      result = trueSize - v.(Field).getOffsetInClass(c)
    )
  )