C++: Restructure UnsafeUseOfStrcat for performance

This query gets optimized badly, and it has started timing out when we
run it on our own code base. Most of the evaluation time is spent in an
RA predicate named `#select#cpe#1#f#antijoin_rhs#1`, which takes 1m36s a
Wireshark snapshot.

This restructuring of the code makes the problematic RA predicate go
away.
This commit is contained in:
Jonas Jensen
2018-09-12 09:29:56 +02:00
parent b17aeb689c
commit 9fb5fbd995

View File

@@ -29,11 +29,20 @@ predicate isEffectivelyConstAccess(VariableAccess a)
)
}
from FunctionCall fc, VariableAccess src
where fc.getTarget().hasName("strcat") and
src = fc.getArgument(1) and
not src.getType() instanceof ArrayType and
class StrcatSource extends VariableAccess {
FunctionCall strcat;
StrcatSource() {
strcat.getTarget().hasName("strcat") and
this = strcat.getArgument(1)
}
FunctionCall getStrcatCall() { result = strcat }
}
from StrcatSource src
where not src.getType() instanceof ArrayType and
not exists(BufferSizeExpr bse |
bse.getArg().(VariableAccess).getTarget() = src.getTarget()) and
not isEffectivelyConstAccess(src)
select fc, "Always check the size of the source buffer when using strcat."
select src.getStrcatCall(), "Always check the size of the source buffer when using strcat."