hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-03 04:39:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Fix blowup in 'stripPointer'.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2022-12-07 22:35:37 +00:00
parent 5ae3228928
commit 9f85175ee1
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternalsCommon.qll
View File

@@ -134,6 +134,8 @@ class AllocationInstruction extends CallInstruction {
* purposes of dataflow.
*/
abstract class Indirection extends Type {
Type baseType;
/** Gets the type of this indirection. */
final Type getType() { result = super.getUnspecifiedType() }
@@ -159,11 +161,12 @@ abstract class Indirection extends Type {
predicate isAdditionalWrite(Node0Impl value, Operand address, boolean certain) { none() }
/**
* Gets the base type of this indirection.
* Gets the base type of this indirection, after specifiers have been deeply
* stripped and typedefs have been resolved.
*
* For example, the base type of `int*&` is `int*`, and the base type of `int*` is `int`.
*/
abstract Type getBaseType();
final Type getBaseType() { result = baseType.getUnspecifiedType() }
/** Holds if there should be an additional taint step from `node1` to `node2`. */
predicate isAdditionalTaintStep(Node node1, Node node2) { none() }
@@ -181,14 +184,14 @@ abstract class Indirection extends Type {
predicate ignoreSourceVariableBase(BaseSourceVariableInstruction base, Node0Impl value) { none() }
}
private class PointerOrReferenceTypeIndirection extends Indirection, PointerOrReferenceType {
private class PointerOrReferenceTypeIndirection extends Indirection instanceof PointerOrReferenceType {
PointerOrReferenceTypeIndirection() { baseType = PointerOrReferenceType.super.getBaseType() }
override int getNumberOfIndirections() { result = 1 + countIndirections(this.getBaseType()) }
override predicate isAdditionalDereference(Instruction deref, Operand address) { none() }
override predicate isAdditionalWrite(Node0Impl value, Operand address, boolean certain) { none() }
override Type getBaseType() { result = PointerOrReferenceType.super.getBaseType() }
}
predicate isDereference(Instruction deref, Operand address) {