From 2e76f3471a24836dac27de6a176ccc4821c03ebe Mon Sep 17 00:00:00 2001 From: Taus Date: Mon, 23 Mar 2026 23:17:22 +0000 Subject: [PATCH] C++: Fix bad join in `callsVariadicFormatter` On `wireshark` this reduces the intermediate tuple count from roughly 88 million tuples to roughly 3000 (with the new helper predicate materialising ~300 tuples). --- cpp/ql/lib/semmle/code/cpp/commons/Printf.qll | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/commons/Printf.qll b/cpp/ql/lib/semmle/code/cpp/commons/Printf.qll index 023ce09c5c1..d189dd36f87 100644 --- a/cpp/ql/lib/semmle/code/cpp/commons/Printf.qll +++ b/cpp/ql/lib/semmle/code/cpp/commons/Printf.qll @@ -163,12 +163,23 @@ predicate primitiveVariadicFormatter( ) } +/** + * Gets a function call whose target is a variadic formatter with the given + * `type`, `format` parameter index and `output` parameter index. + * + * Join-order helper for `callsVariadicFormatter`. + */ +pragma[nomagic] +private predicate callsVariadicFormatterCall(FunctionCall fc, string type, int format, int output) { + variadicFormatter(fc.getTarget(), type, format, output) +} + private predicate callsVariadicFormatter( Function f, string type, int formatParamIndex, int outputParamIndex ) { // calls a variadic formatter with `formatParamIndex`, `outputParamIndex` linked exists(FunctionCall fc, int format, int output | - variadicFormatter(pragma[only_bind_into](fc.getTarget()), type, format, output) and + callsVariadicFormatterCall(fc, type, format, output) and fc.getEnclosingFunction() = f and fc.getArgument(format) = f.getParameter(formatParamIndex).getAnAccess() and fc.getArgument(output) = f.getParameter(outputParamIndex).getAnAccess() @@ -176,7 +187,7 @@ private predicate callsVariadicFormatter( or // calls a variadic formatter with only `formatParamIndex` linked exists(FunctionCall fc, string calledType, int format, int output | - variadicFormatter(pragma[only_bind_into](fc.getTarget()), calledType, format, output) and + callsVariadicFormatterCall(fc, calledType, format, output) and fc.getEnclosingFunction() = f and fc.getArgument(format) = f.getParameter(formatParamIndex).getAnAccess() and not fc.getArgument(output) = f.getParameter(_).getAnAccess() and