hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-04 21:25:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

C++: Fix accidental cartesian product.

Browse Source
This commit is contained in:
Mathias Vorreiter Pedersen
2023-05-04 09:59:16 +01:00
parent 0d6fdc674b
commit d3d706d9ab
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
cpp/ql/lib/experimental/semmle/code/cpp/dataflow/ProductFlow.qll
View File

@@ -368,6 +368,7 @@ module ProductFlow {
TJump()
private predicate into1(Flow1::PathNode pred1, Flow1::PathNode succ1, TKind kind) {
Flow1::PathGraph::edges(pred1, succ1) and
exists(DataFlowCall call |
kind = TInto(call) and
pred1.getNode().(ArgumentNode).getCall() = call and
@@ -376,6 +377,7 @@ module ProductFlow {
}
private predicate out1(Flow1::PathNode pred1, Flow1::PathNode succ1, TKind kind) {
Flow1::PathGraph::edges(pred1, succ1) and
exists(ReturnKindExt returnKind, DataFlowCall call |
kind = TOutOf(call) and
succ1.getNode() = returnKind.getAnOutNode(call) and
@@ -383,19 +385,21 @@ module ProductFlow {
)
}
private predicate into2(Flow2::PathNode pred1, Flow2::PathNode succ1, TKind kind) {
private predicate into2(Flow2::PathNode pred2, Flow2::PathNode succ2, TKind kind) {
Flow2::PathGraph::edges(pred2, succ2) and
exists(DataFlowCall call |
kind = TInto(call) and
pred1.getNode().(ArgumentNode).getCall() = call and
succ1.getNode() instanceof ParameterNode
pred2.getNode().(ArgumentNode).getCall() = call and
succ2.getNode() instanceof ParameterNode
)
}
private predicate out2(Flow2::PathNode pred1, Flow2::PathNode succ1, TKind kind) {
private predicate out2(Flow2::PathNode pred2, Flow2::PathNode succ2, TKind kind) {
Flow2::PathGraph::edges(pred2, succ2) and
exists(ReturnKindExt returnKind, DataFlowCall call |
kind = TOutOf(call) and
succ1.getNode() = returnKind.getAnOutNode(call) and
pred1.getNode().(ReturnNodeExt).getKind() = returnKind
succ2.getNode() = returnKind.getAnOutNode(call) and
pred2.getNode().(ReturnNodeExt).getKind() = returnKind
)
}