[CPP-340] For MistypedFunctionArguments.ql, add support for pointers to pointers and pointers to arrays.

cpp/ql/src/Likely Bugs/Underspecified Functions/MistypedFunctionArguments.ql

@@ -28,7 +28,7 @@ predicate arithTypesMatch(Type arg, Type parm) {
 }
 
 pragma[inline]
-predicate pointerArgTypeMayBeUsed(Type arg, Type parm) {
+predicate nestedPointerArgTypeMayBeUsed(Type arg, Type parm) {
   // arithmetic types
   arithTypesMatch(arg, parm)
   or
@@ -38,6 +38,18 @@ predicate pointerArgTypeMayBeUsed(Type arg, Type parm) {
   parm instanceof VoidType
 }
 
+pragma[inline]
+predicate pointerArgTypeMayBeUsed(Type arg, Type parm) {
+  nestedPointerArgTypeMayBeUsed(arg, parm)
+  or
+  // nested pointers
+  nestedPointerArgTypeMayBeUsed(arg.(PointerType).getBaseType().getUnspecifiedType(),
+    parm.(PointerType).getBaseType().getUnspecifiedType())
+  or
+  nestedPointerArgTypeMayBeUsed(arg.(ArrayType).getBaseType().getUnspecifiedType(),
+    parm.(PointerType).getBaseType().getUnspecifiedType())
+}
+
 pragma[inline]
 predicate argTypeMayBeUsed(Type arg, Type parm) {
   // arithmetic types
@@ -58,10 +70,8 @@ predicate argTypeMayBeUsed(Type arg, Type parm) {
     parm.(ArrayType).getBaseType().getUnspecifiedType())
 }
 
-// This predicate doesn't necessarily have to exist, but if it does exist
-// then it must be inline to make sure we don't enumerate all pairs of
-// compatible types.
-// Its body could also just be hand-inlined where it's used.
+// This predicate holds whenever expression `arg` may be used to initialize
+// function parameter `parm` without need for run-time conversion.
 pragma[inline]
 predicate argMayBeUsed(Expr arg, Parameter parm) {
   argTypeMayBeUsed(arg.getFullyConverted().getType().getUnspecifiedType(),

cpp/ql/src/Likely Bugs/Underspecified Functions/TooFewArguments.ql

@@ -1,9 +1,10 @@
 /**
  * @name Call to function with fewer arguments than declared parameters
- * @description A function call passed fewer arguments than the number of
+ * @description A function call is passing fewer arguments than the number of
  *              declared parameters of the function. This may indicate
- *              that the code does not follow the author's intent. It is also a vulnerability,
- *              since the function is like to operate on undefined data.
+ *              that the code does not follow the author's intent. It is also 
+ *              a vulnerability, since the function is likely to operate on 
+ *              undefined data.
  * @kind problem
  * @problem.severity error
  * @precision very-high