mirror of
https://github.com/github/codeql.git
synced 2026-04-30 11:15:13 +02:00
C++: Restructure UnsafeUseOfStrcat for performance
This query gets optimized badly, and it has started timing out when we run it on our own code base. Most of the evaluation time is spent in an RA predicate named `#select#cpe#1#f#antijoin_rhs#1`, which takes 1m36s a Wireshark snapshot. This restructuring of the code makes the problematic RA predicate go away.
This commit is contained in:
@@ -29,11 +29,20 @@ predicate isEffectivelyConstAccess(VariableAccess a)
|
||||
)
|
||||
}
|
||||
|
||||
from FunctionCall fc, VariableAccess src
|
||||
where fc.getTarget().hasName("strcat") and
|
||||
src = fc.getArgument(1) and
|
||||
not src.getType() instanceof ArrayType and
|
||||
class StrcatSource extends VariableAccess {
|
||||
FunctionCall strcat;
|
||||
|
||||
StrcatSource() {
|
||||
strcat.getTarget().hasName("strcat") and
|
||||
this = strcat.getArgument(1)
|
||||
}
|
||||
|
||||
FunctionCall getStrcatCall() { result = strcat }
|
||||
}
|
||||
|
||||
from StrcatSource src
|
||||
where not src.getType() instanceof ArrayType and
|
||||
not exists(BufferSizeExpr bse |
|
||||
bse.getArg().(VariableAccess).getTarget() = src.getTarget()) and
|
||||
not isEffectivelyConstAccess(src)
|
||||
select fc, "Always check the size of the source buffer when using strcat."
|
||||
select src.getStrcatCall(), "Always check the size of the source buffer when using strcat."
|
||||
|
||||
Reference in New Issue
Block a user