hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10994 from rdmarsh2/rdmarsh2/return-cstr-repair

Browse Source 
C++: repair the ReturnCstr query
This commit is contained in:
Robert Marsh
2022-10-27 14:25:22 -04:00
committed by GitHub
parent e43422a090 24cb36a1e2
commit b7e42e805b
5 changed files with 112 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
View File

@@ -738,11 +738,20 @@ private predicate exprNodeShouldBeIndirectOperand(IndirectOperand node, Expr e,
not convertedExprMustBeOperand(e)
}
private predicate exprNodeShouldBeIndirectOutNode(IndirectArgumentOutNode node, Expr e) {
exists(CallInstruction call |
call.getStaticCallTarget() instanceof Constructor and
e = call.getConvertedResultExpression() and
call.getThisArgumentOperand() = node.getAddressOperand()
)
}
/** Holds if `node` should be an instruction node that maps `node.asExpr()` to `e`. */
predicate exprNodeShouldBeInstruction(Node node, Expr e) {
e = node.asInstruction().getConvertedResultExpression() and
not exprNodeShouldBeOperand(_, e) and
not exprNodeShouldBeIndirectOperand(_, e, _)
not exprNodeShouldBeIndirectOperand(_, e, _) and
not exprNodeShouldBeIndirectOutNode(_, e)
}
private class ExprNodeBase extends Node {
@@ -792,6 +801,16 @@ private class IndirectOperandExprNode extends ExprNodeBase, IndirectOperand {
final override string toStringImpl() { result = this.getConvertedExpr().toString() }
}
private class IndirectArgumentOutExprNode extends ExprNodeBase, IndirectArgumentOutNode {
IndirectArgumentOutExprNode() { exprNodeShouldBeIndirectOutNode(this, _) }
final override Expr getConvertedExpr() { exprNodeShouldBeIndirectOutNode(this, result) }
final override Expr getExpr() { result = this.getConvertedExpr() }
final override string toStringImpl() { result = this.getConvertedExpr().toString() }
}
/**
* An expression, viewed as a node in a data flow graph.
*/