mirror of
https://github.com/github/codeql.git
synced 2026-05-04 13:15:21 +02:00
C++: Fix resource-not-released-in-destructor CP
By moving a disjunct outside the scope of an `exists(Function f`
variable it doens't use, the code becomes clearer and can be optimized
better.
The CP in the QL code did not lead to a CP at evaluation time since the
optimizer was smart enough to compensate for it:
376161 ~37597630% {0} r1 = SCAN functions OUTPUT {}
1 ~0% {0} r2 = STREAM DEDUP r1
Before this change, the largest tuple count in `leakedInSameMethod` on
bitcoin/bitcoin was 2M. Now it's 400k.
This commit is contained in:
@@ -230,13 +230,13 @@ predicate leakedInSameMethod(Resource r, Expr acquire) {
|
||||
)
|
||||
)
|
||||
)
|
||||
or
|
||||
exists(FunctionAccess fa, string kind |
|
||||
// the address of a function that releases `r` is taken (and likely
|
||||
// used to release `r` at some point).
|
||||
r.acquisitionWithRequiredKind(acquire, kind) and
|
||||
fa.getTarget() = r.getAReleaseExpr(kind).getEnclosingFunction()
|
||||
)
|
||||
)
|
||||
or
|
||||
exists(FunctionAccess fa, string kind |
|
||||
// the address of a function that releases `r` is taken (and likely
|
||||
// used to release `r` at some point).
|
||||
r.acquisitionWithRequiredKind(acquire, kind) and
|
||||
fa.getTarget() = r.getAReleaseExpr(kind).getEnclosingFunction()
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user