Ensure SetFormatterAssignment lhs/rhs match up

Introduce abstract `SanitizingFormatter` class as a base for all
sanitizing formatters

.github/actions/os-version/action.yml

@@ -0,0 +1,32 @@
+name: OS Version
+description: Get OS version.
+
+outputs:
+  version:
+    description: "OS version"
+    value: ${{ steps.version.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    - if: runner.os == 'Linux'
+      shell: bash
+      run: |
+        . /etc/os-release
+        echo "VERSION=${NAME} ${VERSION}" >> $GITHUB_ENV
+    - if: runner.os == 'Windows'
+      shell: powershell
+      run: |
+        $objects = systeminfo.exe /FO CSV | ConvertFrom-Csv
+        "VERSION=$($objects.'OS Name') $($objects.'OS Version')" >> $env:GITHUB_ENV
+    - if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        echo "VERSION=$(sw_vers -productName) $(sw_vers -productVersion)" >> $GITHUB_ENV
+    - name: Emit OS version
+      id: version
+      shell: bash
+      run: |
+        echo "$VERSION"
+        echo "version=${VERSION}" >> $GITHUB_OUTPUT
+

.github/workflows/check-change-note.yml

@@ -26,3 +26,9 @@ jobs:
         run: |
           gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
           grep true -c
+      - name: Fail if the change note filename doesn't match the expected format. The file name must be of the form 'YYYY-MM-DD.md' or 'YYYY-MM-DD-{title}.md', where '{title}' is arbitrary text.
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq '[.[].filename | select(test("/change-notes/.*[.]md$"))] | all(test("/change-notes/[0-9]{4}-[0-9]{2}-[0-9]{2}.*[.]md$"))' |
+          grep true -c

.github/workflows/mad_modelDiff.yml

@@ -11,7 +11,7 @@ on:
     branches:
       - main
     paths:
-      - "java/ql/src/utils/model-generator/**/*.*"
+      - "java/ql/src/utils/modelgenerator/**/*.*"
       - ".github/workflows/mad_modelDiff.yml"
 
 permissions:
@@ -40,12 +40,12 @@ jobs:
       - name: Download database
         env:
           SLUG: ${{ matrix.slug }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -x
           mkdir lib-dbs
           SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
-          projectId=`curl -s https://lgtm.com/api/v1.0/projects/g/${SLUG} | jq .id`
+          gh api -H "Accept: application/zip" "/repos/${SLUG}/code-scanning/codeql/databases/java" > "$SHORTNAME.zip"
-          curl -L "https://lgtm.com/api/v1.0/snapshots/$projectId/java" -o "$SHORTNAME.zip"
           unzip -q -d "${SHORTNAME}-db" "${SHORTNAME}.zip"
           mkdir "lib-dbs/$SHORTNAME/"
           mv "${SHORTNAME}-db/"$(ls -1 "${SHORTNAME}"-db)/* "lib-dbs/${SHORTNAME}/"
@@ -61,7 +61,7 @@ jobs:
             DATABASE=$2
             cd codeql-$QL_VARIANT
             SHORTNAME=`basename $DATABASE`
-            python java/ql/src/utils/model-generator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE ${SHORTNAME}.temp.model.yml
+            python java/ql/src/utils/modelgenerator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE ${SHORTNAME}.temp.model.yml
             mv java/ql/lib/ext/generated/${SHORTNAME}.temp.model.yml $MODELS/${SHORTNAME}Generated_${QL_VARIANT}.model.yml
             cd ..
           }
@@ -100,4 +100,6 @@ jobs:
         with:
           name: diffs
           path: tmp-models/*.html
+          # An html file is only produced if the generated models differ.
+          if-no-files-found: ignore
           retention-days: 20

.github/workflows/mad_regenerate-models.yml

@@ -50,7 +50,7 @@ jobs:
           SLUG: ${{ matrix.slug }}
         run: |
           SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
-          java/ql/src/utils/model-generator/RegenerateModels.py "${SLUG}" dbs/${SHORTNAME}
+          java/ql/src/utils/modelgenerator/RegenerateModels.py "${SLUG}" dbs/${SHORTNAME}
       - name: Stage changes
         run: |
           find java -name "*.model.yml" -print0 | xargs -0 git add

.github/workflows/ql-for-ql-build.yml

@@ -27,7 +27,7 @@ jobs:
         uses: ./.github/actions/find-latest-bundle
       - name: Find codeql
         id: find-codeql
-        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
+        uses: github/codeql-action/init@45955cb1830b640e2c1603ad72ad542a49d47b96
         with:
           languages: javascript # does not matter
           tools: ${{ steps.find-latest-bundle.outputs.url }}
@@ -38,12 +38,14 @@ jobs:
         shell: bash
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
+      - uses: ./.github/actions/os-version
+        id: os_version
       - name: Cache entire pack
         id: cache-pack
         uses: actions/cache@v3
         with:
           path: ${{ runner.temp }}/pack
-          key: ${{ runner.os }}-pack-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/**/qlpack.yml') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}--${{ hashFiles('.github/workflows/ql-for-ql-build.yml') }}
+          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-pack-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/**/qlpack.yml') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}--${{ hashFiles('.github/workflows/ql-for-ql-build.yml') }}
       - name: Cache queries
         if: steps.cache-pack.outputs.cache-hit != 'true'
         id: cache-queries
@@ -77,7 +79,7 @@ jobs:
             ql/target/release/ql-autobuilder.exe
             ql/target/release/ql-extractor
             ql/target/release/ql-extractor.exe
-          key: ${{ runner.os }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}
+          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}
       - name: Cache cargo
         if: steps.cache-extractor.outputs.cache-hit != 'true' && steps.cache-pack.outputs.cache-hit != 'true'
         uses: actions/cache@v3
@@ -86,7 +88,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-rust-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
+          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-rust-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
       - name: Check formatting
         if: steps.cache-extractor.outputs.cache-hit != 'true' && steps.cache-pack.outputs.cache-hit != 'true'
         run: cd ql; cargo fmt --all -- --check
@@ -137,20 +139,20 @@ jobs:
         env:
           CONF: ./ql-for-ql-config.yml
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
+        uses: github/codeql-action/init@45955cb1830b640e2c1603ad72ad542a49d47b96
         with:
           languages: ql
           db-location: ${{ runner.temp }}/db
           config-file: ./ql-for-ql-config.yml
           tools: ${{ steps.find-latest-bundle.outputs.url }}
-      - name: Move pack cache
+      - name: Move pack queries
         run: |
-          cp -r ${PACK}/.cache ql/ql/src/.cache
+          cp -r ${PACK}/queries ql/ql/src
         env:
           PACK: ${{ runner.temp }}/pack
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
+        uses: github/codeql-action/analyze@45955cb1830b640e2c1603ad72ad542a49d47b96
         with:
           category: "ql-for-ql"
       - name: Copy sarif file to CWD
@@ -172,4 +174,4 @@ jobs:
         with:
           name: ql-for-ql-langs
           path: split-sarif
-          retention-days: 1
+          retention-days: 1

.github/workflows/ql-for-ql-dataset_measure.yml

@@ -25,16 +25,18 @@ jobs:
 
       - name: Find codeql
         id: find-codeql
-        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
+        uses: github/codeql-action/init@45955cb1830b640e2c1603ad72ad542a49d47b96
         with:
           languages: javascript # does not matter
+      - uses: ./.github/actions/os-version
+        id: os_version
       - uses: actions/cache@v3
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
+          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
       - name: Build Extractor
         run: cd ql; env "PATH=$PATH:`dirname ${CODEQL}`" ./scripts/create-extractor-pack.sh
         env:

.github/workflows/ql-for-ql-tests.yml

@@ -22,28 +22,84 @@ jobs:
       - uses: actions/checkout@v3
       - name: Find codeql
         id: find-codeql
-        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
+        uses: github/codeql-action/init@45955cb1830b640e2c1603ad72ad542a49d47b96
         with:
           languages: javascript # does not matter
+      - uses: ./.github/actions/os-version
+        id: os_version
       - uses: actions/cache@v3
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             ql/target
-          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
+          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-qltest-cargo-${{ hashFiles('ql/rust-toolchain.toml', 'ql/**/Cargo.lock') }}
       - name: Build extractor
         run: |
           cd ql;
           codeqlpath=$(dirname ${{ steps.find-codeql.outputs.codeql-path }});
           env "PATH=$PATH:$codeqlpath" ./scripts/create-extractor-pack.sh
+      - name: Cache compilation cache
+        id: query-cache
+        uses: ./.github/actions/cache-query-compilation
+        with: 
+          key: ql-for-ql-tests
       - name: Run QL tests
         run: |
-          "${CODEQL}" test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --search-path "${{ github.workspace }}/ql/extractor-pack" --consistency-queries ql/ql/consistency-queries ql/ql/test
+          "${CODEQL}" test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --search-path "${{ github.workspace }}/ql/extractor-pack" --consistency-queries ql/ql/consistency-queries --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" ql/ql/test
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
-      - name: Check QL formatting
+
+  other-os: 
+    strategy:
+      matrix:
+        os: [macos-latest, windows-latest]
+    needs: [qltest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Install GNU tar 
+        if: runner.os == 'macOS'
         run: |
-          find ql/ql/src "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 "${CODEQL}" query format --check-only
+          brew install gnu-tar
+          echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
+      - name: Find codeql
+        id: find-codeql
+        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
+        with:
+          languages: javascript # does not matter
+      - uses: ./.github/actions/os-version
+        id: os_version
+      - uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ql/target
+          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-qltest-cargo-${{ hashFiles('ql/rust-toolchain.toml', 'ql/**/Cargo.lock') }}
+      - name: Build extractor
+        if: runner.os != 'Windows'
+        run: |
+          cd ql;
+          codeqlpath=$(dirname ${{ steps.find-codeql.outputs.codeql-path }});
+          env "PATH=$PATH:$codeqlpath" ./scripts/create-extractor-pack.sh
+      - name: Build extractor (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          cd ql;
+          $Env:PATH += ";$(dirname ${{ steps.find-codeql.outputs.codeql-path }})"
+          pwsh ./scripts/create-extractor-pack.ps1
+      - name: Run a single QL tests - Unix
+        if: runner.os != 'Windows'
+        run: |
+          "${CODEQL}" test run --check-databases --search-path "${{ github.workspace }}/ql/extractor-pack" ql/ql/test/queries/style/DeadCode/DeadCode.qlref
         env:
           CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
+      - name: Run a single QL tests - Windows
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $Env:PATH += ";$(dirname ${{ steps.find-codeql.outputs.codeql-path }})"
+          codeql test run --check-databases --search-path "${{ github.workspace }}/ql/extractor-pack" ql/ql/test/queries/style/DeadCode/DeadCode.qlref
+      

.github/workflows/ruby-build.yml

@@ -48,6 +48,8 @@ jobs:
         run: |
           brew install gnu-tar
           echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
+      - uses: ./.github/actions/os-version
+        id: os_version
       - name: Cache entire extractor
         uses: actions/cache@v3
         id: cache-extractor
@@ -58,7 +60,7 @@ jobs:
             ruby/target/release/ruby-extractor
             ruby/target/release/ruby-extractor.exe
             ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
-          key: ${{ runner.os }}-ruby-extractor-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}--${{ hashFiles('ruby/**/*.rs') }}
+          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-extractor-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}--${{ hashFiles('ruby/**/*.rs') }}
       - uses: actions/cache@v3
         if: steps.cache-extractor.outputs.cache-hit != 'true'
         with:
@@ -66,7 +68,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             ruby/target
-          key: ${{ runner.os }}-ruby-rust-cargo-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}
+          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-rust-cargo-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}
       - name: Check formatting
         if: steps.cache-extractor.outputs.cache-hit != 'true'
         run: cargo fmt --all -- --check
@@ -203,11 +205,6 @@ jobs:
       - name: Fetch CodeQL
         uses: ./.github/actions/fetch-codeql
 
-      - uses: actions/checkout@v3
-        with:
-          repository: Shopify/example-ruby-app
-          ref: 67a0decc5eb550f3a9228eda53925c3afd40dfe9
-
       - name: Download Ruby bundle
         uses: actions/download-artifact@v3
         with:
@@ -216,26 +213,15 @@ jobs:
       - name: Unzip Ruby bundle
         shell: bash
         run: unzip -q -d "${{ runner.temp }}/ruby-bundle" "${{ runner.temp }}/codeql-ruby-bundle.zip"
-      - name: Prepare test files
+
-        shell: bash
-        run: |
-          echo "import codeql.ruby.AST select count(File f)" > "test.ql"
-          echo "| 4 |" > "test.expected"
-          echo 'name: sample-tests
-          version: 0.0.0
-          dependencies:
-            codeql/ruby-all: "*"
-          extractor: ruby
-          tests: .
-          ' > qlpack.yml
       - name: Run QL test
         shell: bash
         run: |
-          codeql test run --search-path "${{ runner.temp }}/ruby-bundle" --additional-packs "${{ runner.temp }}/ruby-bundle" .
+          codeql test run --search-path "${{ runner.temp }}/ruby-bundle" --additional-packs "${{ runner.temp }}/ruby-bundle" ruby/ql/test/library-tests/ast/constants/
       - name: Create database
         shell: bash
         run: |
-          codeql database create --search-path "${{ runner.temp }}/ruby-bundle" --language ruby --source-root . ../database
+          codeql database create --search-path "${{ runner.temp }}/ruby-bundle" --language ruby --source-root ruby/ql/test/library-tests/ast/constants/ ../database
       - name: Analyze database
         shell: bash
         run: |

CONTRIBUTING.md

@@ -25,6 +25,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
 
     Each language-specific directory contains further subdirectories that group queries based on their `@tags` or purpose.
     - Experimental queries and libraries are stored in the `experimental` subdirectory within each language-specific directory in the [CodeQL repository](https://github.com/github/codeql). For example, experimental Java queries and libraries are stored in `java/ql/src/experimental` and any corresponding tests in `java/ql/test/experimental`.
+    - Experimental queries need to include `experimental` in their `@tags`
     - The structure of an `experimental` subdirectory mirrors the structure of its parent directory.
     - Select or create an appropriate directory in `experimental` based on the existing directory structure of `experimental` or its parent directory.
 

config/identical-files.json

@@ -402,16 +402,6 @@
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll",
     "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll"
   ],
-  "Inline Test Expectations": [
-    "cpp/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "csharp/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "java/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "python/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "ruby/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "ql/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "go/ql/test/TestUtilities/InlineExpectationsTest.qll",
-    "swift/ql/test/TestUtilities/InlineExpectationsTest.qll"
-  ],
   "C++ ExternalAPIs": [
     "cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll",
     "cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll"

cpp/downgrades/23f7cbb88a4eb29f30c3490363dc201bc054c5ff/exprs.ql

@@ -13,5 +13,5 @@ predicate isExprWithNewBuiltin(Expr expr) {
 from Expr expr, int kind, int kind_new, Location location
 where
   exprs(expr, kind, location) and
-  if isExprWithNewBuiltin(expr) then kind_new = 0 else kind_new = kind
+  if isExprWithNewBuiltin(expr) then kind_new = 1 else kind_new = kind
 select expr, kind_new, location

cpp/downgrades/73af5058c6899dcdb05754c27ca966aeb3a68c94/exprs.ql

@@ -9,5 +9,5 @@ class Location extends @location_expr {
 from Expr expr, int kind, int kind_new, Location location
 where
   exprs(expr, kind, location) and
-  if expr instanceof @blockassignexpr then kind_new = 0 else kind_new = kind
+  if expr instanceof @blockassignexpr then kind_new = 1 else kind_new = kind
 select expr, kind_new, location

cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/builtintypes.ql

@@ -0,0 +1,11 @@
+class BuiltinType extends @builtintype {
+  string toString() { none() }
+}
+
+from BuiltinType type, string name, int kind, int kind_new, int size, int sign, int alignment
+where
+  builtintypes(type, name, kind, size, sign, alignment) and
+  if type instanceof @float16 or type instanceof @complex_float16
+  then kind_new = 2
+  else kind_new = kind
+select type, name, kind_new, size, sign, alignment

cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/upgrade.properties

@@ -0,0 +1,3 @@
+description: Introduce (_Complex) _Float16 type
+compatibility: backwards
+builtintypes.rel: run builtintypes.qlo

cpp/downgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/upgrade.properties

@@ -0,0 +1,2 @@
+description: Uncomment case splits in dbscheme
+compatibility: full

cpp/ql/lib/definitions.qll

@@ -123,6 +123,13 @@ private predicate constructorCallTypeMention(ConstructorCall cc, TypeMention tm)
   )
 }
 
+/** Holds if `loc` has the container `container` and is on the line starting at `startLine`. */
+pragma[nomagic]
+private predicate hasContainerAndStartLine(Location loc, Container container, int startLine) {
+  loc.getStartLine() = startLine and
+  loc.getContainer() = container
+}
+
 /**
  * Gets an element, of kind `kind`, that element `e` uses, if any.
  * Attention: This predicate yields multiple definitions for a single location.
@@ -159,9 +166,9 @@ Top definitionOf(Top e, string kind) {
     // Multiple type mentions can be generated when a typedef is used, and
     // in such cases we want to exclude all but the originating typedef.
     not exists(Type secondary |
-      exists(TypeMention tm, File f, int startline, int startcol |
+      exists(File f, int startline, int startcol |
         typeMentionStartLoc(e, result, f, startline, startcol) and
-        typeMentionStartLoc(tm, secondary, f, startline, startcol) and
+        typeMentionStartLoc(_, secondary, f, startline, startcol) and
         (
           result = secondary.(TypedefType).getBaseType() or
           result = secondary.(TypedefType).getBaseType().(SpecifiedType).getBaseType()
@@ -184,11 +191,9 @@ Top definitionOf(Top e, string kind) {
     kind = "I" and
     result = e.(Include).getIncludedFile() and
     // exclude `#include` directives containing macros
-    not exists(MacroInvocation mi, Location l1, Location l2 |
+    not exists(MacroInvocation mi, Container container, int startLine |
-      l1 = e.(Include).getLocation() and
+      hasContainerAndStartLine(e.(Include).getLocation(), container, startLine) and
-      l2 = mi.getLocation() and
+      hasContainerAndStartLine(mi.getLocation(), container, startLine)
-      l1.getContainer() = l2.getContainer() and
-      l1.getStartLine() = l2.getStartLine()
       // (an #include directive must be always on it's own line)
     )
   ) and

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -45,6 +45,16 @@ module Consistency {
     ) {
       none()
     }
+
+    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
+    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
+      none()
+    }
+
+    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
+    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -101,9 +111,7 @@ module Consistency {
     exists(int c |
       c =
         strictcount(Node n |
-          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+          not n.hasLocationInfo(_, _, _, _, _) and
-            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-          ) and
           not any(ConsistencyConfiguration conf).missingLocationExclude(n)
         ) and
       msg = "Nodes without location: " + c
@@ -248,6 +256,7 @@ module Consistency {
   query predicate uniqueParameterNodeAtPosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
+    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
     msg = "Parameters with overlapping positions."
@@ -256,6 +265,7 @@ module Consistency {
   query predicate uniqueParameterNodePosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
+    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
     msg = "Parameter node with multiple positions."

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/ArrayLengthAnalysis.qll

@@ -218,7 +218,7 @@ private predicate allocation(Instruction array, Length length, int delta) {
           length.(VNLength).getInstruction().getConvertedResultExpression() = lengthExpr
         )
         or
-        not exists(int d | deconstructMallocSizeExpr(alloc.getSizeExpr(), _, d)) and
+        not deconstructMallocSizeExpr(alloc.getSizeExpr(), _, _) and
         length.(VNLength).getInstruction().getConvertedResultExpression() = alloc.getSizeExpr() and
         delta = 0
       )

cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/RangeAnalysis.qll

@@ -543,9 +543,7 @@ private predicate boundedPhiCand(
   PhiInstruction phi, boolean upper, Bound b, int delta, boolean fromBackEdge, int origdelta,
   Reason reason
 ) {
-  exists(PhiInputOperand op |
+  boundedPhiInp(phi, _, b, delta, upper, fromBackEdge, origdelta, reason)
-    boundedPhiInp(phi, op, b, delta, upper, fromBackEdge, origdelta, reason)
-  )
 }
 
 /**

cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll

@@ -664,9 +664,7 @@ private predicate boundedPhiCand(
   SemSsaPhiNode phi, boolean upper, SemBound b, int delta, boolean fromBackEdge, int origdelta,
   SemReason reason
 ) {
-  exists(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge |
+  boundedPhiInp(phi, _, _, b, delta, upper, fromBackEdge, origdelta, reason)
-    boundedPhiInp(phi, inp, edge, b, delta, upper, fromBackEdge, origdelta, reason)
-  )
 }
 
 /**

cpp/ql/lib/qlpack.yml

@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.5.0
+version: 0.5.1-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp

cpp/ql/lib/semmle/code/cpp/Function.qll

@@ -318,7 +318,7 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
   MetricFunction getMetrics() { result = this }
 
   /** Holds if this function calls the function `f`. */
-  predicate calls(Function f) { exists(Locatable l | this.calls(f, l)) }
+  predicate calls(Function f) { this.calls(f, _) }
 
   /**
    * Holds if this function calls the function `f` in the `FunctionCall`
@@ -335,7 +335,7 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
   }
 
   /** Holds if this function accesses a function or variable or enumerator `a`. */
-  predicate accesses(Declaration a) { exists(Locatable l | this.accesses(a, l)) }
+  predicate accesses(Declaration a) { this.accesses(a, _) }
 
   /**
    * Holds if this function accesses a function or variable or enumerator `a`

cpp/ql/lib/semmle/code/cpp/Location.qll

@@ -10,12 +10,14 @@ import semmle.code.cpp.File
  */
 class Location extends @location {
   /** Gets the container corresponding to this location. */
+  pragma[nomagic]
   Container getContainer() { this.fullLocationInfo(result, _, _, _, _) }
 
   /** Gets the file corresponding to this location, if any. */
   File getFile() { result = this.getContainer() }
 
   /** Gets the 1-based line number (inclusive) where this location starts. */
+  pragma[nomagic]
   int getStartLine() { this.fullLocationInfo(_, result, _, _, _) }
 
   /** Gets the 1-based column number (inclusive) where this location starts. */

cpp/ql/lib/semmle/code/cpp/Type.qll

@@ -816,6 +816,12 @@ private predicate floatingPointTypeMapping(
   or
   // _Float128x
   kind = 50 and base = 2 and domain = TRealDomain() and realKind = 50 and extended = true
+  or
+  // _Float16
+  kind = 52 and base = 2 and domain = TRealDomain() and realKind = 52 and extended = false
+  or
+  // _Complex _Float16
+  kind = 53 and base = 2 and domain = TComplexDomain() and realKind = 52 and extended = false
 }
 
 /**

cpp/ql/lib/semmle/code/cpp/commons/Dependency.qll

@@ -33,7 +33,7 @@ DependencyOptions getDependencyOptions() { any() }
 class DependsSource extends Element {
   DependsSource() {
     // not inside a template instantiation
-    not exists(Element other | this.isFromTemplateInstantiation(other)) or
+    not this.isFromTemplateInstantiation(_) or
     // allow DeclarationEntrys of template specializations
     this.(DeclarationEntry).getDeclaration().(Function).isConstructedFrom(_) or
     this.(DeclarationEntry).getDeclaration().(Class).isConstructedFrom(_)

cpp/ql/lib/semmle/code/cpp/commons/Exclusions.qll

@@ -69,12 +69,9 @@ predicate functionContainsDisabledCode(Function f) {
  */
 predicate functionContainsPreprocCode(Function f) {
   // `f` contains a preprocessor branch
-  exists(
+  exists(string file, int pbdStartLine, int fBlockStartLine, int fBlockEndLine |
-    PreprocessorBranchDirective pbd, string file, int pbdStartLine, int fBlockStartLine,
-    int fBlockEndLine
-  |
     functionLocation(f, file, fBlockStartLine, fBlockEndLine) and
-    pbdLocation(pbd, file, pbdStartLine) and
+    pbdLocation(_, file, pbdStartLine) and
     pbdStartLine <= fBlockEndLine and
     pbdStartLine >= fBlockStartLine
   )

cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll

@@ -244,9 +244,7 @@ class ScanfFormatLiteral extends Expr {
   /**
    * Gets the maximum width option of the nth input (empty string if none is given).
    */
-  string getMaxWidthOpt(int n) {
+  string getMaxWidthOpt(int n) { this.parseConvSpec(n, _, result, _, _) }
-    exists(string spec, string len, string conv | this.parseConvSpec(n, spec, result, len, conv))
-  }
 
   /**
    * Gets the maximum width of the nth input.
@@ -256,18 +254,12 @@ class ScanfFormatLiteral extends Expr {
   /**
    * Gets the length flag of the nth conversion specifier.
    */
-  string getLength(int n) {
+  string getLength(int n) { this.parseConvSpec(n, _, _, result, _) }
-    exists(string spec, string width, string conv |
-      this.parseConvSpec(n, spec, width, result, conv)
-    )
-  }
 
   /**
    * Gets the conversion character of the nth conversion specifier.
    */
-  string getConversionChar(int n) {
+  string getConversionChar(int n) { this.parseConvSpec(n, _, _, _, result) }
-    exists(string spec, string width, string len | this.parseConvSpec(n, spec, width, len, result))
-  }
 
   /**
    * Gets the maximum length of the string that can be produced by the nth

cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll

@@ -54,7 +54,7 @@ class SubBasicBlock extends ControlFlowNodeBase {
    * only condition under which a `SubBasicBlock` may have multiple
    * predecessors.
    */
-  predicate firstInBB() { exists(BasicBlock bb | this.getRankInBasicBlock(bb) = 1) }
+  predicate firstInBB() { this.getRankInBasicBlock(_) = 1 }
 
   /**
    * Holds if this `SubBasicBlock` comes last in its basic block. This is the

cpp/ql/lib/semmle/code/cpp/controlflow/internal/ConstantExprs.qll

@@ -441,8 +441,8 @@ library class ExprEvaluator extends int {
       req = mid.(AssignExpr).getRValue()
     )
     or
-    exists(VariableAccess va, Variable v, boolean sub1 |
+    exists(Variable v, boolean sub1 |
-      this.interestingVariableAccess(e, va, v, sub1) and
+      this.interestingVariableAccess(e, _, v, sub1) and
       req = v.getAnAssignedValue() and
       (sub1 = true implies not this.ignoreVariableAssignment(e, v, req)) and
       sub = false
@@ -876,7 +876,7 @@ private predicate nonAnalyzableVariableDefinition(Variable v, StmtParent def) {
  * empirically to have effect only on a few rare and pathological examples.
  */
 private predicate tractableVariable(Variable v) {
-  not exists(StmtParent def | nonAnalyzableVariableDefinition(v, def)) or
+  not nonAnalyzableVariableDefinition(v, _) or
   strictcount(StmtParent def | nonAnalyzableVariableDefinition(v, def)) < 1000
 }
 

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll

@@ -45,6 +45,16 @@ module Consistency {
     ) {
       none()
     }
+
+    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
+    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
+      none()
+    }
+
+    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
+    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -101,9 +111,7 @@ module Consistency {
     exists(int c |
       c =
         strictcount(Node n |
-          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+          not n.hasLocationInfo(_, _, _, _, _) and
-            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-          ) and
           not any(ConsistencyConfiguration conf).missingLocationExclude(n)
         ) and
       msg = "Nodes without location: " + c
@@ -248,6 +256,7 @@ module Consistency {
   query predicate uniqueParameterNodeAtPosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
+    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
     msg = "Parameters with overlapping positions."
@@ -256,6 +265,7 @@ module Consistency {
   query predicate uniqueParameterNodePosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
+    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
     msg = "Parameter node with multiple positions."

cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll

@@ -450,10 +450,8 @@ module FlowVar_internal {
     }
 
     override string toString() {
-      exists(Expr e |
+      this.definedByExpr(_, _) and
-        this.definedByExpr(e, _) and
+      result = "assignment to " + v
-        result = "assignment to " + v
-      )
       or
       this.definedByInitialValue(_) and
       result = "initial value of " + v

cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll

@@ -54,7 +54,7 @@ class SubBasicBlock extends ControlFlowNodeBase {
    * only condition under which a `SubBasicBlock` may have multiple
    * predecessors.
    */
-  predicate firstInBB() { exists(BasicBlock bb | this.getRankInBasicBlock(bb) = 1) }
+  predicate firstInBB() { this.getRankInBasicBlock(_) = 1 }
 
   /**
    * Holds if this `SubBasicBlock` comes last in its basic block. This is the

cpp/ql/lib/semmle/code/cpp/dispatch/VirtualDispatchPrototype.qll

@@ -70,8 +70,8 @@ module VirtualDispatch {
    * that is, `c` or one of its supertypes overrides `f`.
    */
   private predicate cannotInherit(Class c, MemberFunction f) {
-    exists(Class overridingType, MemberFunction override |
+    exists(MemberFunction override |
-      cannotInheritHelper(c, f, overridingType, override) and
+      cannotInheritHelper(c, f, _, override) and
       override.overrides+(f)
     )
   }

cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll

@@ -53,7 +53,7 @@ class Expr extends StmtParent, @expr {
   Declaration getEnclosingDeclaration() { result = exprEnclosingElement(this) }
 
   /** Gets a child of this expression. */
-  Expr getAChild() { exists(int n | result = this.getChild(n)) }
+  Expr getAChild() { result = this.getChild(_) }
 
   /** Gets the parent of this expression, if any. */
   Element getParent() { exprparents(underlyingElement(this), _, unresolveElement(result)) }

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll

@@ -876,9 +876,9 @@ private module Stage1 implements StageSig {
 
   pragma[nomagic]
   private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(DataFlowCall call, NodeEx out |
+    exists(NodeEx out |
       revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
     )
   }
 
@@ -1731,8 +1731,8 @@ private module MkStage<StageSig PrevStage> {
       )
       or
       // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
       )
       or
@@ -1901,8 +1901,8 @@ private module MkStage<StageSig PrevStage> {
 
     pragma[nomagic]
     predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(RetNodeEx ret, ReturnPosition pos |
+      exists(ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, ap, _, config) and
+        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
         parameterFlowsThroughRev(p, ap, pos, _, config)
       )
     }
@@ -1923,8 +1923,8 @@ private module MkStage<StageSig PrevStage> {
       DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
       Ap ap, Configuration config
     ) {
-      exists(ParamNodeEx p, ReturnPosition pos, Ap innerReturnAp |
+      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, pos, returnAp, ap, innerReturnAp, config) and
+        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
         flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
       )
     }
@@ -3749,8 +3749,8 @@ private predicate paramFlowsThrough(
   ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
   AccessPathApprox apa, Configuration config
 ) {
-  exists(PathNodeMid mid, RetNodeEx ret |
+  exists(RetNodeEx ret |
-    pathNode(mid, ret, state, cc, sc, ap, config, _) and
+    pathNode(_, ret, state, cc, sc, ap, config, _) and
     kind = ret.getKind() and
     apa = ap.getApprox() and
     parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,17 +4212,15 @@ private module FlowExploration {
       ap = TRevPartialNil() and
       exists(config.explorationLimit())
       or
-      exists(PartialPathNodeRev mid |
+      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+      not clearsContentEx(node, ap.getHead()) and
-        not clearsContentEx(node, ap.getHead()) and
+      (
-        (
+        notExpectsContent(node) or
-          notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead())
-          expectsContentEx(node, ap.getHead())
+      ) and
-        ) and
+      not fullBarrier(node, config) and
-        not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
-        not stateBarrier(node, state, config) and
+      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
-      )
     }
 
   pragma[nomagic]
@@ -4230,19 +4228,17 @@ private module FlowExploration {
     NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
     TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
   ) {
-    exists(PartialPathNodeFwd mid |
+    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+    not fullBarrier(node, config) and
-      not fullBarrier(node, config) and
+    not stateBarrier(node, state, config) and
-      not stateBarrier(node, state, config) and
+    not clearsContentEx(node, ap.getHead().getContent()) and
-      not clearsContentEx(node, ap.getHead().getContent()) and
+    (
-      (
+      notExpectsContent(node) or
-        notExpectsContent(node) or
+      expectsContentEx(node, ap.getHead().getContent())
-        expectsContentEx(node, ap.getHead().getContent())
+    ) and
-      ) and
+    if node.asNode() instanceof CastingNode
-      if node.asNode() instanceof CastingNode
+    then compatibleTypes(node.getDataFlowType(), ap.getType())
-      then compatibleTypes(node.getDataFlowType(), ap.getType())
+    else any()
-      else any()
-    )
   }
 
   /**

cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll

@@ -45,6 +45,16 @@ module Consistency {
     ) {
       none()
     }
+
+    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
+    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
+      none()
+    }
+
+    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
+    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
+      none()
+    }
   }
 
   private class RelevantNode extends Node {
@@ -101,9 +111,7 @@ module Consistency {
     exists(int c |
       c =
         strictcount(Node n |
-          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+          not n.hasLocationInfo(_, _, _, _, _) and
-            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
-          ) and
           not any(ConsistencyConfiguration conf).missingLocationExclude(n)
         ) and
       msg = "Nodes without location: " + c
@@ -248,6 +256,7 @@ module Consistency {
   query predicate uniqueParameterNodeAtPosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
+    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
     msg = "Parameters with overlapping positions."
@@ -256,6 +265,7 @@ module Consistency {
   query predicate uniqueParameterNodePosition(
     DataFlowCallable c, ParameterPosition pos, Node p, string msg
   ) {
+    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
     isParameterNode(p, c, pos) and
     not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
     msg = "Parameter node with multiple positions."

cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll

@@ -30,6 +30,7 @@ private newtype TOpcode =
   TNegate() or
   TShiftLeft() or
   TShiftRight() or
+  TUnsignedShiftRight() or
   TBitAnd() or
   TBitOr() or
   TBitXor() or
@@ -652,6 +653,15 @@ module Opcode {
     final override string toString() { result = "ShiftRight" }
   }
 
+  /**
+   * The `Opcode` for a `UnsignedShiftRightInstruction`.
+   *
+   * See the `UnsignedShiftRightInstruction` documentation for more details.
+   */
+  class UnsignedShiftRight extends BinaryBitwiseOpcode, TUnsignedShiftRight {
+    final override string toString() { result = "UnsignedShiftRight" }
+  }
+
   /**
    * The `Opcode` for a `BitAndInstruction`.
    *

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll

@@ -1204,6 +1204,17 @@ class ShiftRightInstruction extends BinaryBitwiseInstruction {
   ShiftRightInstruction() { this.getOpcode() instanceof Opcode::ShiftRight }
 }
 
+/**
+ * An instruction that shifts its left operand to the right by the number of bits specified by its
+ * right operand.
+ *
+ * Both operands must have an integer type. The result has the same type as the left operand.
+ * The leftmost bits are zero-filled.
+ */
+class UnsignedShiftRightInstruction extends BinaryBitwiseInstruction {
+  UnsignedShiftRightInstruction() { this.getOpcode() instanceof Opcode::UnsignedShiftRight }
+}
+
 /**
  * An instruction that performs a binary arithmetic operation involving at least one pointer
  * operand.

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll

@@ -45,7 +45,7 @@ class Operand extends TStageOperand {
       this = reusedPhiOperand(use, def, predecessorBlock, _)
     )
     or
-    exists(Instruction use | this = chiOperand(use, _))
+    this = chiOperand(_, _)
   }
 
   /** Gets a textual representation of this element. */

cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll

@@ -329,12 +329,12 @@ private module Cached {
   cached
   Instruction getChiInstructionTotalOperand(ChiInstruction chiInstr) {
     exists(
-      Alias::VirtualVariable vvar, OldInstruction oldInstr, Alias::MemoryLocation defLocation,
+      Alias::VirtualVariable vvar, OldInstruction oldInstr, OldBlock defBlock, int defRank,
-      OldBlock defBlock, int defRank, int defOffset, OldBlock useBlock, int useRank
+      int defOffset, OldBlock useBlock, int useRank
     |
       chiInstr = getChi(oldInstr) and
       vvar = Alias::getResultMemoryLocation(oldInstr).getVirtualVariable() and
-      hasDefinitionAtRank(vvar, defLocation, defBlock, defRank, defOffset) and
+      hasDefinitionAtRank(vvar, _, defBlock, defRank, defOffset) and
       hasUseAtRank(vvar, useBlock, useRank, oldInstr) and
       definitionReachesUse(vvar, defBlock, defRank, useBlock, useRank) and
       result = getDefinitionOrChiInstruction(defBlock, defOffset, vvar, _)

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll

@@ -1204,6 +1204,17 @@ class ShiftRightInstruction extends BinaryBitwiseInstruction {
   ShiftRightInstruction() { this.getOpcode() instanceof Opcode::ShiftRight }
 }
 
+/**
+ * An instruction that shifts its left operand to the right by the number of bits specified by its
+ * right operand.
+ *
+ * Both operands must have an integer type. The result has the same type as the left operand.
+ * The leftmost bits are zero-filled.
+ */
+class UnsignedShiftRightInstruction extends BinaryBitwiseInstruction {
+  UnsignedShiftRightInstruction() { this.getOpcode() instanceof Opcode::UnsignedShiftRight }
+}
+
 /**
  * An instruction that performs a binary arithmetic operation involving at least one pointer
  * operand.

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll

@@ -45,7 +45,7 @@ class Operand extends TStageOperand {
       this = reusedPhiOperand(use, def, predecessorBlock, _)
     )
     or
-    exists(Instruction use | this = chiOperand(use, _))
+    this = chiOperand(_, _)
   }
 
   /** Gets a textual representation of this element. */

cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll

@@ -298,11 +298,11 @@ class TranslatedStringLiteralInitialization extends TranslatedDirectInitializati
     opcode instanceof Opcode::Store and
     resultType = getTypeForPRValue(expr.getType())
     or
-    exists(int startIndex, int elementCount |
+    exists(int elementCount |
       // If the initializer string isn't large enough to fill the target, then
       // we have to generate another instruction sequence to store a constant
       // zero into the remainder of the array.
-      zeroInitRange(startIndex, elementCount) and
+      zeroInitRange(_, elementCount) and
       (
         // Create a constant zero whose size is the size of the remaining
         // space in the target array.

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll

@@ -1204,6 +1204,17 @@ class ShiftRightInstruction extends BinaryBitwiseInstruction {
   ShiftRightInstruction() { this.getOpcode() instanceof Opcode::ShiftRight }
 }
 
+/**
+ * An instruction that shifts its left operand to the right by the number of bits specified by its
+ * right operand.
+ *
+ * Both operands must have an integer type. The result has the same type as the left operand.
+ * The leftmost bits are zero-filled.
+ */
+class UnsignedShiftRightInstruction extends BinaryBitwiseInstruction {
+  UnsignedShiftRightInstruction() { this.getOpcode() instanceof Opcode::UnsignedShiftRight }
+}
+
 /**
  * An instruction that performs a binary arithmetic operation involving at least one pointer
  * operand.

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll

@@ -45,7 +45,7 @@ class Operand extends TStageOperand {
       this = reusedPhiOperand(use, def, predecessorBlock, _)
     )
     or
-    exists(Instruction use | this = chiOperand(use, _))
+    this = chiOperand(_, _)
   }
 
   /** Gets a textual representation of this element. */

cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll

@@ -329,12 +329,12 @@ private module Cached {
   cached
   Instruction getChiInstructionTotalOperand(ChiInstruction chiInstr) {
     exists(
-      Alias::VirtualVariable vvar, OldInstruction oldInstr, Alias::MemoryLocation defLocation,
+      Alias::VirtualVariable vvar, OldInstruction oldInstr, OldBlock defBlock, int defRank,
-      OldBlock defBlock, int defRank, int defOffset, OldBlock useBlock, int useRank
+      int defOffset, OldBlock useBlock, int useRank
     |
       chiInstr = getChi(oldInstr) and
       vvar = Alias::getResultMemoryLocation(oldInstr).getVirtualVariable() and
-      hasDefinitionAtRank(vvar, defLocation, defBlock, defRank, defOffset) and
+      hasDefinitionAtRank(vvar, _, defBlock, defRank, defOffset) and
       hasUseAtRank(vvar, useBlock, useRank, oldInstr) and
       definitionReachesUse(vvar, defBlock, defRank, useBlock, useRank) and
       result = getDefinitionOrChiInstruction(defBlock, defOffset, vvar, _)

cpp/ql/lib/semmle/code/cpp/ir/internal/IRCppLanguage.qll

@@ -67,9 +67,7 @@ class Class = Cpp::Class; // Used for inheritance conversions
 
 predicate getIdentityString = Print::getIdentityString/1;
 
-predicate hasCaseEdge(string minValue, string maxValue) {
+predicate hasCaseEdge(string minValue, string maxValue) { hasCaseEdge(_, minValue, maxValue) }
-  exists(Cpp::SwitchCase switchCase | hasCaseEdge(switchCase, minValue, maxValue))
-}
 
 predicate hasPositionalArgIndex(int argIndex) {
   exists(Cpp::FunctionCall call | exists(call.getArgument(argIndex))) or

cpp/ql/lib/semmle/code/cpp/metrics/MetricClass.qll

@@ -99,10 +99,10 @@ class MetricClass extends Class {
   }
 
   /** Gets any method that accesses some local field. */
-  Function getAccessingMethod() { exists(Field f | this.accessesLocalField(result, f)) }
+  Function getAccessingMethod() { this.accessesLocalField(result, _) }
 
   /** Gets any field that is accessed by a local method. */
-  Field getAccessedField() { exists(Function func | this.accessesLocalField(func, result)) }
+  Field getAccessedField() { this.accessesLocalField(_, result) }
 
   /** Gets the Henderson-Sellers lack-of-cohesion metric. */
   float getLackOfCohesionHS() {
@@ -517,10 +517,10 @@ private predicate dependsOnClassSimple(Class source, Class dest) {
     )
     or
     // a class depends on classes for which a call to its member function is done from a function
-    exists(MemberFunction target, MemberFunction f, Locatable l |
+    exists(MemberFunction target, MemberFunction f |
       f.getDeclaringType() = source and
       f instanceof MemberFunction and
-      f.calls(target, l) and
+      f.calls(target, _) and
       target instanceof MemberFunction and
       target.getDeclaringType() = dest
     )

cpp/ql/lib/semmle/code/cpp/models/interfaces/Allocation.qll

@@ -133,13 +133,15 @@ abstract class HeuristicAllocationExpr extends Expr {
 
   /**
    * Gets a constant multiplier for the allocation size given by `getSizeExpr`,
-   * in bytes.
+   * in bytes. This predicate should be used with caution as it can be
+   * inaccurate for allocations identified using heuristics.
    */
   int getSizeMult() { none() }
 
   /**
    * Gets the size of this allocation in bytes, if it is a fixed size and that
-   * size can be determined.
+   * size can be determined. This predicate should be used with caution as it
+   * can be inaccurate for allocations identified using heuristics.
    */
   int getSizeBytes() { none() }
 

cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll

@@ -296,7 +296,7 @@ private predicate analyzableExpr(Expr e) {
     or
     // Also allow variable accesses, provided that they have SSA
     // information.
-    exists(RangeSsaDefinition def, StackVariable v | e = def.getAUse(v))
+    exists(RangeSsaDefinition def | e = def.getAUse(_))
     or
     e instanceof UnsignedBitwiseAndExpr
     or

cpp/ql/lib/semmle/code/cpp/security/TaintTrackingImpl.qll

@@ -127,9 +127,9 @@ deprecated private predicate betweenFunctionsValueMoveTo(
   not unreachable(src) and
   not unreachable(dest) and
   (
-    exists(Call call, Function called, int i |
+    exists(Call call, int i |
       src = call.getArgument(i) and
-      resolveCallWithParam(call, called, i, dest) and
+      resolveCallWithParam(call, _, i, dest) and
       destFromArg = true
     )
     or
@@ -151,8 +151,8 @@ deprecated private predicate betweenFunctionsValueMoveTo(
     )
     or
     // If a parameter of type reference is tainted inside a function, taint the argument too
-    exists(Call call, Function f, int pi, Parameter p |
+    exists(Call call, int pi, Parameter p |
-      resolveCallWithParam(call, f, pi, p) and
+      resolveCallWithParam(call, _, pi, p) and
       p.getType() instanceof ReferenceType and
       src = p and
       dest = call.getArgument(pi) and

cpp/ql/lib/semmle/code/cpp/stmts/Stmt.qll

@@ -34,7 +34,7 @@ class Stmt extends StmtParent, @stmt {
   }
 
   /** Gets a child of this statement. */
-  Element getAChild() { exists(int n | result = this.getChild(n)) }
+  Element getAChild() { result = this.getChild(_) }
 
   /** Gets the parent of this statement, if any. */
   StmtParent getParent() { stmtparents(underlyingElement(this), _, unresolveElement(result)) }

cpp/ql/lib/semmle/code/cpp/valuenumbering/HashCons.qll

@@ -475,9 +475,7 @@ private predicate mk_NonmemberFunctionCall(Function fcn, HC_Args args, FunctionC
   fc.getTarget() = fcn and
   analyzableNonmemberFunctionCall(fc) and
   (
-    exists(HashCons head, HC_Args tail |
+    mk_ArgConsInner(_, _, fc.getNumberOfArguments() - 1, args, fc)
-      mk_ArgConsInner(head, tail, fc.getNumberOfArguments() - 1, args, fc)
-    )
     or
     fc.getNumberOfArguments() = 0 and
     args = HC_EmptyArgs()
@@ -494,9 +492,7 @@ private predicate analyzableExprCall(ExprCall ec) {
 private predicate mk_ExprCall(HashCons hc, HC_Args args, ExprCall ec) {
   hc.getAnExpr() = ec.getExpr() and
   (
-    exists(HashCons head, HC_Args tail |
+    mk_ArgConsInner(_, _, ec.getNumberOfArguments() - 1, args, ec)
-      mk_ArgConsInner(head, tail, ec.getNumberOfArguments() - 1, args, ec)
-    )
     or
     ec.getNumberOfArguments() = 0 and
     args = HC_EmptyArgs()
@@ -516,9 +512,7 @@ private predicate mk_MemberFunctionCall(Function fcn, HashCons qual, HC_Args arg
   analyzableMemberFunctionCall(fc) and
   hashCons(fc.getQualifier().getFullyConverted()) = qual and
   (
-    exists(HashCons head, HC_Args tail |
+    mk_ArgConsInner(_, _, fc.getNumberOfArguments() - 1, args, fc)
-      mk_ArgConsInner(head, tail, fc.getNumberOfArguments() - 1, args, fc)
-    )
     or
     fc.getNumberOfArguments() = 0 and
     args = HC_EmptyArgs()
@@ -541,10 +535,8 @@ private predicate mk_ArgCons(HashCons hc, int i, HC_Args list, Call c) {
   analyzableCall(c) and
   hc = hashCons(c.getArgument(i).getFullyConverted()) and
   (
-    exists(HashCons head, HC_Args tail |
+    mk_ArgConsInner(_, _, i - 1, list, c) and
-      mk_ArgConsInner(head, tail, i - 1, list, c) and
+    i > 0
-      i > 0
-    )
     or
     i = 0 and
     list = HC_EmptyArgs()

cpp/ql/lib/semmlecode.cpp.dbscheme

@@ -303,12 +303,11 @@ affectedbymacroexpansion(
     int inv: @macroinvocation ref
 );
 
-/*
+case @macroinvocation.kind of
-  case @macroinvocations.kind of
+  1 = @macro_expansion
-    1 = macro expansion
+| 2 = @other_macro_reference
-  | 2 = other macro reference
+;
-  ;
+
-*/
 macroinvocations(
     unique int id: @macroinvocation,
     int macro_id: @ppd_define ref,
@@ -345,28 +344,37 @@ macro_argument_expanded(
 );
 
 /*
-  case @function.kind of
+case @function.kind of
-    1 = normal
+  1 = @normal_function
-  | 2 = constructor
+| 2 = @constructor
-  | 3 = destructor
+| 3 = @destructor
-  | 4 = conversion
+| 4 = @conversion_function
-  | 5 = operator
+| 5 = @operator
-  | 6 = builtin     // GCC built-in functions, e.g. __builtin___memcpy_chk
+| 6 = @builtin_function     // GCC built-in functions, e.g. __builtin___memcpy_chk
-  ;
+;
 */
+
 functions(
     unique int id: @function,
     string name: string ref,
     int kind: int ref
 );
 
-function_entry_point(int id: @function ref, unique int entry_point: @stmt ref);
+function_entry_point(
+    int id: @function ref,
+    unique int entry_point: @stmt ref
+);
 
-function_return_type(int id: @function ref, int return_type: @type ref);
+function_return_type(
+    int id: @function ref,
+    int return_type: @type ref
+);
 
-/** If `function` is a coroutine, then this gives the
+/**
-    std::experimental::resumable_traits instance associated with it,
+ * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
-    and the variables representing the `handle` and `promise` for it. */
+ * instance associated with it, and the variables representing the `handle` and `promise`
+ * for it.
+ */
 coroutine(
   unique int function: @function ref,
   int traits: @type ref,
@@ -392,7 +400,10 @@ function_deleted(unique int id: @function ref);
 
 function_defaulted(unique int id: @function ref);
 
-member_function_this_type(unique int id: @function ref, int this_type: @type ref);
+member_function_this_type(
+    unique int id: @function ref,
+    int this_type: @type ref
+);
 
 #keyset[id, type_id]
 fun_decls(
@@ -495,7 +506,10 @@ params(
     int type_id: @type ref
 );
 
-overrides(int new: @function ref, int old: @function ref);
+overrides(
+    int new: @function ref,
+    int old: @function ref
+);
 
 #keyset[id, type_id]
 membervariables(
@@ -541,63 +555,65 @@ enumconstants(
 
 @localscopevariable = @localvariable | @parameter;
 
-/*
+/**
-  Built-in types are the fundamental types, e.g., integral, floating, and void.
+ * Built-in types are the fundamental types, e.g., integral, floating, and void.
+ */
+case @builtintype.kind of
+   1 = @errortype
+|  2 = @unknowntype
+|  3 = @void
+|  4 = @boolean
+|  5 = @char
+|  6 = @unsigned_char
+|  7 = @signed_char
+|  8 = @short
+|  9 = @unsigned_short
+| 10 = @signed_short
+| 11 = @int
+| 12 = @unsigned_int
+| 13 = @signed_int
+| 14 = @long
+| 15 = @unsigned_long
+| 16 = @signed_long
+| 17 = @long_long
+| 18 = @unsigned_long_long
+| 19 = @signed_long_long
+// ... 20 Microsoft-specific __int8
+// ... 21 Microsoft-specific __int16
+// ... 22 Microsoft-specific __int32
+// ... 23 Microsoft-specific __int64
+| 24 = @float
+| 25 = @double
+| 26 = @long_double
+| 27 = @complex_float         // C99-specific _Complex float
+| 28 = @complex_double        // C99-specific _Complex double
+| 29 = @complex_long_double   // C99-specific _Complex long double
+| 30 = @imaginary_float       // C99-specific _Imaginary float
+| 31 = @imaginary_double      // C99-specific _Imaginary double
+| 32 = @imaginary_long_double // C99-specific _Imaginary long double
+| 33 = @wchar_t               // Microsoft-specific
+| 34 = @decltype_nullptr      // C++11
+| 35 = @int128                // __int128
+| 36 = @unsigned_int128       // unsigned __int128
+| 37 = @signed_int128         // signed __int128
+| 38 = @float128              // __float128
+| 39 = @complex_float128      // _Complex __float128
+| 40 = @decimal32             // _Decimal32
+| 41 = @decimal64             // _Decimal64
+| 42 = @decimal128            // _Decimal128
+| 43 = @char16_t
+| 44 = @char32_t
+| 45 = @std_float32           // _Float32
+| 46 = @float32x              // _Float32x
+| 47 = @std_float64           // _Float64
+| 48 = @float64x              // _Float64x
+| 49 = @std_float128          // _Float128
+| 50 = @float128x             // _Float128x
+| 51 = @char8_t
+| 52 = @float16               // _Float16
+| 53 = @complex_float16       // _Complex _Float16
+;
 
-  case @builtintype.kind of
-    1 = error
-  | 2 = unknown
-  | 3 = void
-  | 4 = boolean
-  | 5 = char
-  | 6 = unsigned_char
-  | 7 = signed_char
-  | 8 = short
-  | 9 = unsigned_short
-  | 10 = signed_short
-  | 11 = int
-  | 12 = unsigned_int
-  | 13 = signed_int
-  | 14 = long
-  | 15 = unsigned_long
-  | 16 = signed_long
-  | 17 = long_long
-  | 18 = unsigned_long_long
-  | 19 = signed_long_long
-  | 20 = __int8                 // Microsoft-specific
-  | 21 = __int16                // Microsoft-specific
-  | 22 = __int32                // Microsoft-specific
-  | 23 = __int64                // Microsoft-specific
-  | 24 = float
-  | 25 = double
-  | 26 = long_double
-  | 27 = _Complex_float         // C99-specific
-  | 28 = _Complex_double        // C99-specific
-  | 29 = _Complex_long double   // C99-specific
-  | 30 = _Imaginary_float       // C99-specific
-  | 31 = _Imaginary_double      // C99-specific
-  | 32 = _Imaginary_long_double // C99-specific
-  | 33 = wchar_t                // Microsoft-specific
-  | 34 = decltype_nullptr       // C++11
-  | 35 = __int128
-  | 36 = unsigned___int128
-  | 37 = signed___int128
-  | 38 = __float128
-  | 39 = _Complex___float128
-  | 40 = _Decimal32
-  | 41 = _Decimal64
-  | 42 = _Decimal128
-  | 43 = char16_t
-  | 44 = char32_t
-  | 45 = _Float32
-  | 46 = _Float32x
-  | 47 = _Float64
-  | 48 = _Float64x
-  | 49 = _Float128
-  | 50 = _Float128x
-  | 51 = char8_t
-  ;
-*/
 builtintypes(
     unique int id: @builtintype,
     string name: string ref,
@@ -607,23 +623,23 @@ builtintypes(
     int alignment: int ref
 );
 
-/*
+/**
-  Derived types are types that are directly derived from existing types and
+ * Derived types are types that are directly derived from existing types and
-  point to, refer to, transform type data to return a new type.
+ * point to, refer to, transform type data to return a new type.
-
+ */
-  case @derivedtype.kind of
+case @derivedtype.kind of
-    1 = pointer
+   1 = @pointer
-  | 2 = reference
+|  2 = @reference
-  | 3 = type_with_specifiers
+|  3 = @type_with_specifiers
-  | 4 = array
+|  4 = @array
-  | 5 = gnu_vector
+|  5 = @gnu_vector
-  | 6 = routineptr
+|  6 = @routineptr
-  | 7 = routinereference
+|  7 = @routinereference
-  | 8 = rvalue_reference // C++11
+|  8 = @rvalue_reference // C++11
 // ... 9 type_conforming_to_protocols deprecated
-  | 10 = block
+| 10 = @block
-  ;
+;
-*/
+
 derivedtypes(
     unique int id: @derivedtype,
     string name: string ref,
@@ -675,23 +691,24 @@ decltypes(
 );
 
 /*
-  case @usertype.kind of
+case @usertype.kind of
-    1 = struct
+   1 = @struct
-  | 2 = class
+|  2 = @class
-  | 3 = union
+|  3 = @union
-  | 4 = enum
+|  4 = @enum
-  | 5 = typedef                       // classic C: typedef typedef type name
+|  5 = @typedef                       // classic C: typedef typedef type name
-  | 6 = template
+|  6 = @template
-  | 7 = template_parameter
+|  7 = @template_parameter
-  | 8 = template_template_parameter
+|  8 = @template_template_parameter
-  | 9 = proxy_class                   // a proxy class associated with a template parameter
+|  9 = @proxy_class                   // a proxy class associated with a template parameter
 // ... 10 objc_class deprecated
 // ... 11 objc_protocol deprecated
 // ... 12 objc_category deprecated
-  | 13 = scoped_enum
+| 13 = @scoped_enum
-  | 14 = using_alias                  // a using name = type style typedef
+| 14 = @using_alias                  // a using name = type style typedef
-  ;
+;
 */
+
 usertypes(
     unique int id: @usertype,
     string name: string ref,
@@ -1162,7 +1179,10 @@ case @funbindexpr.kind of
 | 2 = @adl_call     // a call whose target is only found by ADL
 ;
 */
-iscall(unique int caller: @funbindexpr ref, int kind: int ref);
+iscall(
+    unique int caller: @funbindexpr ref,
+    int kind: int ref
+);
 
 numtemplatearguments(
     unique int expr_id: @expr ref,

cpp/ql/lib/upgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/upgrade.properties

@@ -0,0 +1,2 @@
+description: Uncomment case splits in dbscheme
+compatibility: full

cpp/ql/lib/upgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/upgrade.properties

@@ -0,0 +1,2 @@
+description: Introduce (_Complex) _Float16 type
+compatibility: full

cpp/ql/src/Best Practices/Magic Constants/JapaneseEraDate.ql

@@ -44,14 +44,11 @@ predicate eraDate(int year, int month, int day) {
 }
 
 predicate badStructInitialization(Element target, string message) {
-  exists(
+  exists(StructLikeClass s, YearFieldAccess year, int yearValue, int monthValue, int dayValue |
-    StructLikeClass s, YearFieldAccess year, MonthFieldAccess month, DayFieldAccess day,
-    int yearValue, int monthValue, int dayValue
-  |
     eraDate(yearValue, monthValue, dayValue) and
     assignedYear(s, year, yearValue) and
-    assignedMonth(s, month, monthValue) and
+    assignedMonth(s, _, monthValue) and
-    assignedDay(s, day, dayValue) and
+    assignedDay(s, _, dayValue) and
     target = year and
     message = "A time struct that is initialized with exact Japanese calendar era start date."
   )

cpp/ql/src/Best Practices/Magic Constants/MagicConstants.qll

@@ -129,9 +129,7 @@ predicate literalIsEnumInitializer(Literal literal) {
   exists(EnumConstant ec | ec.getInitializer().getExpr() = literal)
 }
 
-predicate literalInArrayInitializer(Literal literal) {
+predicate literalInArrayInitializer(Literal literal) { arrayInitializerChild(_, literal) }
-  exists(AggregateLiteral arrayInit | arrayInitializerChild(arrayInit, literal))
-}
 
 predicate arrayInitializerChild(AggregateLiteral parent, Expr e) {
   e = parent

cpp/ql/src/Critical/DescriptorMayNotBeClosed.ql

@@ -29,7 +29,7 @@ predicate openDefinition(StackVariable v, ControlFlowNode def) {
 }
 
 predicate openReaches(ControlFlowNode def, ControlFlowNode node) {
-  exists(StackVariable v | openDefinition(v, def) and node = def.getASuccessor())
+  openDefinition(_, def) and node = def.getASuccessor()
   or
   exists(StackVariable v, ControlFlowNode mid |
     openDefinition(v, def) and

cpp/ql/src/Critical/MissingCheckScanf.ql

@@ -20,81 +20,190 @@ import semmle.code.cpp.dataflow.DataFlow
 import semmle.code.cpp.ir.IR
 import semmle.code.cpp.ir.ValueNumbering
 
-/** An expression appearing as an output argument to a `scanf`-like call */
+/**
-class ScanfOutput extends Expr {
+ * Holds if `call` is a `scanf`-like function that may write to `output` at index `index`.
-  ScanfFunctionCall call;
+ *
-  int varargIndex;
+ * Furthermore, `instr` is the instruction that defines the address of the `index`'th argument
-  Instruction instr;
+ * of `call`, and `vn` is the value number of `instr.`
-  ValueNumber valNum;
+ */
+predicate isSource(ScanfFunctionCall call, int index, Instruction instr, ValueNumber vn, Expr output) {
+  output = call.getOutputArgument(index).getFullyConverted() and
+  instr.getConvertedResultExpression() = output and
+  vn.getAnInstruction() = instr
+}
 
-  ScanfOutput() {
+/**
-    this = call.getOutputArgument(varargIndex).getFullyConverted() and
+ * Holds if `instr` is control-flow reachable in 0 or more steps from
-    instr.getConvertedResultExpression() = this and
+ * a call to a `scanf`-like function.
-    valueNumber(instr) = valNum
+ */
-  }
+pragma[nomagic]
+predicate fwdFlow0(Instruction instr) {
+  isSource(_, _, instr, _, _)
+  or
+  exists(Instruction prev |
+    fwdFlow0(prev) and
+    prev.getASuccessor() = instr
+  )
+}
 
-  ScanfFunctionCall getCall() { result = call }
+/**
+ * Holds if `instr` is part of the IR translation of `access` that
+ * is not an expression being deallocated, and `instr` has value
+ * number `vn`.
+ */
+predicate isSink(Instruction instr, Access access, ValueNumber vn) {
+  instr.getAst() = access and
+  not any(DeallocationExpr dealloc).getFreedExpr() = access and
+  vn.getAnInstruction() = instr
+}
 
-  /**
+/**
-   * Returns the smallest possible `scanf` return value that would indicate
+ * Holds if `instr` is part of a path from a call to a `scanf`-like function
-   * success in writing this output argument.
+ * to a use of the written variable.
-   */
+ */
-  int getMinimumGuardConstant() {
+pragma[nomagic]
-    result =
+predicate revFlow0(Instruction instr) {
-      varargIndex + 1 -
+  fwdFlow0(instr) and
-        count(ScanfFormatLiteral f, int n |
+  (
-          // Special case: %n writes to an argument without reading any input.
+    isSink(instr, _, _)
-          // It does not increase the count returned by `scanf`.
-          n <= varargIndex and f.getUse() = call and f.getConversionChar(n) = "n"
-        )
-  }
-
-  predicate hasGuardedAccess(Access e, boolean isGuarded) {
-    e = this.getAnAccess() and
-    if
-      exists(int value, int minGuard | minGuard = this.getMinimumGuardConstant() |
-        e.getBasicBlock() = blockGuardedBy(value, "==", call) and minGuard <= value
-        or
-        e.getBasicBlock() = blockGuardedBy(value, "<", call) and minGuard - 1 <= value
-        or
-        e.getBasicBlock() = blockGuardedBy(value, "<=", call) and minGuard <= value
-      )
-    then isGuarded = true
-    else isGuarded = false
-  }
-
-  /**
-   * Get a subsequent access of the same underlying storage,
-   * but before it gets reset or reused in another `scanf` call.
-   */
-  Access getAnAccess() {
-    exists(Instruction dst |
-      this.bigStep() = dst and
-      dst.getAst() = result and
-      valueNumber(dst) = valNum
-    )
-  }
-
-  private Instruction bigStep() {
-    result = this.smallStep(instr)
     or
-    exists(Instruction i | i = this.bigStep() | result = this.smallStep(i))
+    exists(Instruction succ | revFlow0(succ) | instr.getASuccessor() = succ)
-  }
+  )
+}
 
-  private Instruction smallStep(Instruction i) {
+/**
-    instr.getASuccessor*() = i and
+ * Holds if `instr` is part of a path from a call to a `scanf`-like function
-    i.getASuccessor() = result and
+ * that writes to a variable with value number `vn`, without passing through
-    not this.isBarrier(result)
+ * redefinitions of the variable.
-  }
+ */
-
+pragma[nomagic]
-  private predicate isBarrier(Instruction i) {
+private predicate fwdFlow(Instruction instr, ValueNumber vn) {
-    valueNumber(i) = valNum and
+  revFlow0(instr) and
-    exists(Expr e | i.getAst() = e |
+  (
-      i = any(StoreInstruction s).getDestinationAddress()
+    isSource(_, _, instr, vn, _)
-      or
+    or
-      [e, e.getParent().(AddressOfExpr)] instanceof ScanfOutput
+    exists(Instruction prev |
+      fwdFlow(prev, vn) and
+      prev.getASuccessor() = instr and
+      not isBarrier(instr, vn)
     )
-  }
+  )
+}
+
+/**
+ * Holds if `instr` is part of a path from a call to a `scanf`-like function
+ * that writes to a variable with value number `vn`, without passing through
+ * redefinitions of the variable.
+ *
+ * Note: This predicate only holds for the `(intr, vn)` pairs that are also
+ * control-flow reachable from an argument to a `scanf`-like function call.
+ */
+pragma[nomagic]
+predicate revFlow(Instruction instr, ValueNumber vn) {
+  fwdFlow(instr, vn) and
+  (
+    isSink(instr, _, vn)
+    or
+    exists(Instruction succ | revFlow(succ, vn) |
+      instr.getASuccessor() = succ and
+      not isBarrier(succ, vn)
+    )
+  )
+}
+
+/**
+ * A type that bundles together a reachable instruction with the appropriate
+ * value number (i.e., the value number that's transferred from the source
+ * to the sink).
+ */
+newtype TNode = MkNode(Instruction instr, ValueNumber vn) { revFlow(instr, vn) }
+
+class Node extends MkNode {
+  ValueNumber vn;
+  Instruction instr;
+
+  Node() { this = MkNode(instr, vn) }
+
+  final string toString() { result = instr.toString() }
+
+  final Node getASuccessor() { result = MkNode(instr.getASuccessor(), vn) }
+
+  final Location getLocation() { result = instr.getLocation() }
+}
+
+/**
+ * Holds if `instr` is an instruction with value number `vn` that is
+ * used in a store operation, or is overwritten by another call to
+ * a `scanf`-like function.
+ */
+private predicate isBarrier(Instruction instr, ValueNumber vn) {
+  // We only need to compute barriers for instructions that we
+  // managed to hit during the initial flow stage.
+  revFlow0(pragma[only_bind_into](instr)) and
+  valueNumber(instr) = vn and
+  exists(Expr e | instr.getAst() = e |
+    instr = any(StoreInstruction s).getDestinationAddress()
+    or
+    isSource(_, _, _, _, [e, e.getParent().(AddressOfExpr)])
+  )
+}
+
+/** Holds if `n1` steps to `n2` in a single step. */
+predicate isSuccessor(Node n1, Node n2) { n1.getASuccessor() = n2 }
+
+predicate hasFlow(Node n1, Node n2) = fastTC(isSuccessor/2)(n1, n2)
+
+Node getNode(Instruction instr, ValueNumber vn) { result = MkNode(instr, vn) }
+
+/**
+ * Holds if `source` is the `index`'th argument to the `scanf`-like call `call`, and `sink` is
+ * an instruction that is part of the translation of `access` which is a transitive
+ * control-flow successor of `call`.
+ *
+ * Furthermore, `source` and `sink` have identical global value numbers.
+ */
+predicate hasFlow(
+  Instruction source, ScanfFunctionCall call, int index, Instruction sink, Access access
+) {
+  exists(ValueNumber vn |
+    isSource(call, index, source, vn, _) and
+    hasFlow(getNode(source, vn), getNode(sink, vn)) and
+    isSink(sink, access, vn)
+  )
+}
+
+/**
+ * Gets the smallest possible `scanf` return value of `call` that would indicate
+ * success in writing the output argument at index `index`.
+ */
+int getMinimumGuardConstant(ScanfFunctionCall call, int index) {
+  isSource(call, index, _, _, _) and
+  result =
+    index + 1 -
+      count(ScanfFormatLiteral f, int n |
+        // Special case: %n writes to an argument without reading any input.
+        // It does not increase the count returned by `scanf`.
+        n <= index and f.getUse() = call and f.getConversionChar(n) = "n"
+      )
+}
+
+/**
+ * Holds the access to `e` isn't guarded by a check that ensures that `call` returned
+ * at least `minGuard`.
+ */
+predicate hasNonGuardedAccess(ScanfFunctionCall call, Access e, int minGuard) {
+  exists(int index |
+    hasFlow(_, call, index, _, e) and
+    minGuard = getMinimumGuardConstant(call, index)
+  |
+    not exists(int value |
+      e.getBasicBlock() = blockGuardedBy(value, "==", call) and minGuard <= value
+      or
+      e.getBasicBlock() = blockGuardedBy(value, "<", call) and minGuard - 1 <= value
+      or
+      e.getBasicBlock() = blockGuardedBy(value, "<=", call) and minGuard <= value
+    )
+  )
 }
 
 /** Returns a block guarded by the assertion of `value op call` */
@@ -112,12 +221,9 @@ BasicBlock blockGuardedBy(int value, string op, ScanfFunctionCall call) {
   )
 }
 
-from ScanfOutput output, ScanfFunctionCall call, Access access
+from ScanfFunctionCall call, Access access, int minGuard
-where
+where hasNonGuardedAccess(call, access, minGuard)
-  output.getCall() = call and
-  output.hasGuardedAccess(access, false) and
-  not exists(DeallocationExpr dealloc | dealloc.getFreedExpr() = access)
 select access,
   "This variable is read, but may not have been written. " +
-    "It should be guarded by a check that the $@ returns at least " +
+    "It should be guarded by a check that the $@ returns at least " + minGuard + ".", call,
-    output.getMinimumGuardConstant() + ".", call, call.toString()
+  call.toString()

cpp/ql/src/Critical/NewDelete.qll

@@ -159,8 +159,8 @@ predicate freeExprOrIndirect(Expr free, Expr freed, string kind) {
   freeExpr(free, freed, kind)
   or
   // indirect free via function call
-  exists(Expr internalFree, Expr internalFreed, int arg |
+  exists(Expr internalFreed, int arg |
-    freeExprOrIndirect(internalFree, internalFreed, kind) and
+    freeExprOrIndirect(_, internalFreed, kind) and
     free.(FunctionCall).getTarget().getParameter(arg) = internalFreed.(VariableAccess).getTarget() and
     free.(FunctionCall).getArgument(arg) = freed
   )

cpp/ql/src/Documentation/CommentedOutCode.qll

@@ -119,7 +119,7 @@ class CommentBlock extends Comment {
     (
       this instanceof CppStyleComment
       implies
-      not exists(CppStyleComment pred, File f | lineInFile(pred, f) + 1 = lineInFile(this, f))
+      not exists(File f | lineInFile(_, f) + 1 = lineInFile(this, f))
     ) and
     // Ignore comments on the same line as a preprocessor directive.
     not exists(Location l |

cpp/ql/src/Likely Bugs/Format/NonConstantFormat.ql

@@ -134,8 +134,8 @@ class NonConstFlow extends TaintTracking::Configuration {
 from FormattingFunctionCall call, Expr formatString
 where
   call.getArgument(call.getFormatParameterIndex()) = formatString and
-  exists(NonConstFlow cf, DataFlow::Node source, DataFlow::Node sink |
+  exists(NonConstFlow cf, DataFlow::Node sink |
-    cf.hasFlow(source, sink) and
+    cf.hasFlowTo(sink) and
     sink.asExpr() = formatString
   )
 select formatString,

cpp/ql/src/Likely Bugs/Protocols/TlsSettingsMisconfiguration.ql

@@ -48,9 +48,7 @@ predicate isOptionSet(ConstructorCall cc, int flag, FunctionCall fcSetOptions) {
 }
 
 bindingset[flag]
-predicate isOptionNotSet(ConstructorCall cc, int flag) {
+predicate isOptionNotSet(ConstructorCall cc, int flag) { not isOptionSet(cc, flag, _) }
-  not exists(FunctionCall fcSetOptions | isOptionSet(cc, flag, fcSetOptions))
-}
 
 from
   BoostorgAsio::SslContextCallTlsProtocolConfig configConstructor, Expr protocolSource,

cpp/ql/src/Metrics/Dependencies/ExternalDependencies.qll

@@ -28,8 +28,8 @@ private newtype LibraryT =
     lib.getVersion() = version
   } or
   LibraryTExternalPackage(@external_package ep, string name, string version) {
-    exists(string namespace, string package_name |
+    exists(string package_name |
-      external_packages(ep, namespace, package_name, version) and
+      external_packages(ep, _, package_name, version) and
       name = package_name
     )
   }
@@ -42,8 +42,8 @@ class Library extends LibraryT {
   string version;
 
   Library() {
-    exists(LibraryElement lib | this = LibraryTElement(lib, name, version)) or
+    this = LibraryTElement(_, name, version) or
-    exists(@external_package ep | this = LibraryTExternalPackage(ep, name, version))
+    this = LibraryTExternalPackage(_, name, version)
   }
 
   string getName() { result = name }

cpp/ql/src/Metrics/Files/ConditionalSegmentLines.ql

@@ -54,7 +54,7 @@ private PreprocessorDirective next(PreprocessorDirective ppd) {
 
 private int level(PreprocessorDirective ppd) {
   relevantDirective(ppd, _, _) and
-  not exists(PreprocessorDirective previous | ppd = next(previous)) and
+  not ppd = next(_) and
   result = 0
   or
   exists(PreprocessorDirective previous |
@@ -101,8 +101,8 @@ predicate headerGuard(PreprocessorDirective notdef, File f) {
 }
 
 predicate headerGuardChild(PreprocessorDirective open) {
-  exists(File f, PreprocessorDirective headerGuard |
+  exists(File f |
-    headerGuard(headerGuard, f) and
+    headerGuard(_, f) and
     openWithDepth(1, f, open, _)
   )
 }

cpp/ql/src/Security/CWE/CWE-121/UnterminatedVarargsCall.ql

@@ -64,7 +64,7 @@ class VarargsFunction extends Function {
     totalCount = this.totalCount() and
     100 * cnt / totalCount >= 80 and
     // terminator value is not used in a non-terminating position
-    not exists(FunctionCall fc, int index | this.nonTrailingVarArgValue(fc, index) = result)
+    not this.nonTrailingVarArgValue(_, _) = result
   }
 
   predicate isWhitelisted() { this.hasGlobalName(["open", "fcntl", "ptrace", "mremap"]) }

cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql

@@ -21,7 +21,7 @@ import semmle.code.cpp.models.interfaces.ArrayFunction
 import semmle.code.cpp.models.interfaces.Allocation
 import semmle.code.cpp.commons.NullTermination
 
-predicate terminationProblem(AllocationExpr malloc, string msg) {
+predicate terminationProblem(HeuristicAllocationExpr malloc, string msg) {
   // malloc(strlen(...))
   exists(StrlenCall strlen | DataFlow::localExprFlow(strlen, malloc.getSizeExpr())) and
   // flows to a call that implies this is a null-terminated string

cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql

@@ -25,9 +25,8 @@ import DataFlow::PathGraph
  * Holds if `alloc` is an allocation, and `tainted` is a child of it that is a
  * taint sink.
  */
-predicate allocSink(Expr alloc, DataFlow::Node sink) {
+predicate allocSink(HeuristicAllocationExpr alloc, DataFlow::Node sink) {
   exists(Expr e | e = sink.asConvertedExpr() |
-    isAllocationExpr(alloc) and
     e = alloc.getAChild() and
     e.getUnspecifiedType() instanceof IntegralType
   )
@@ -89,6 +88,10 @@ class TaintedAllocationSizeConfiguration extends TaintTracking::Configuration {
       readsVariable(access.getDef(), checkedVar) and
       nodeIsBarrierEqualityCandidate(node, access, checkedVar)
     )
+    or
+    // block flow to inside of identified allocation functions (this flow leads
+    // to duplicate results)
+    any(HeuristicAllocationFunction f).getAParameter() = node.asParameter()
   }
 }
 

cpp/ql/src/Security/CWE/CWE-290/AuthenticationBypass.ql

@@ -15,76 +15,24 @@
 import semmle.code.cpp.ir.dataflow.internal.DefaultTaintTrackingImpl
 import TaintedWithPath
 
+string getATopLevelDomain() {
+  result =
+    [
+      "com", "ru", "net", "org", "de", "jp", "uk", "br", "pl", "in", "it", "fr", "au", "info", "nl",
+      "cn", "ir", "es", "cz", "biz", "ca", "eu", "ua", "kr", "za", "co", "gr", "ro", "se", "tw",
+      "vn", "mx", "ch", "tr", "at", "be", "hu", "tv", "dk", "me", "ar", "us", "no", "sk", "fi",
+      "id", "cl", "nz", "by", "xyz", "pt", "ie", "il", "kz", "my", "hk", "lt", "cc", "sg", "io",
+      "edu", "gov"
+    ]
+}
+
 predicate hardCodedAddressOrIP(StringLiteral txt) {
   exists(string s | s = txt.getValueText() |
     // Hard-coded ip addresses, such as 127.0.0.1
     s.regexpMatch("\"[0-9]+[.][0-9]+[.][0-9]+[.][0-9]+\"") or
     // Hard-coded addresses such as www.mycompany.com
-    s.matches("\"www.%\"") or
+    s.regexpMatch("\"(www\\.|http:|https:).*\"") or
-    s.matches("\"http:%\"") or
+    s.regexpMatch("\".*\\.(" + strictconcat(getATopLevelDomain(), "|") + ")\"")
-    s.matches("\"https:%\"") or
-    s.matches("\"%.com\"") or
-    s.matches("\"%.ru\"") or
-    s.matches("\"%.net\"") or
-    s.matches("\"%.org\"") or
-    s.matches("\"%.de\"") or
-    s.matches("\"%.jp\"") or
-    s.matches("\"%.uk\"") or
-    s.matches("\"%.br\"") or
-    s.matches("\"%.pl\"") or
-    s.matches("\"%.in\"") or
-    s.matches("\"%.it\"") or
-    s.matches("\"%.fr\"") or
-    s.matches("\"%.au\"") or
-    s.matches("\"%.info\"") or
-    s.matches("\"%.nl\"") or
-    s.matches("\"%.cn\"") or
-    s.matches("\"%.ir\"") or
-    s.matches("\"%.es\"") or
-    s.matches("\"%.cz\"") or
-    s.matches("\"%.biz\"") or
-    s.matches("\"%.ca\"") or
-    s.matches("\"%.eu\"") or
-    s.matches("\"%.ua\"") or
-    s.matches("\"%.kr\"") or
-    s.matches("\"%.za\"") or
-    s.matches("\"%.co\"") or
-    s.matches("\"%.gr\"") or
-    s.matches("\"%.ro\"") or
-    s.matches("\"%.se\"") or
-    s.matches("\"%.tw\"") or
-    s.matches("\"%.vn\"") or
-    s.matches("\"%.mx\"") or
-    s.matches("\"%.ch\"") or
-    s.matches("\"%.tr\"") or
-    s.matches("\"%.at\"") or
-    s.matches("\"%.be\"") or
-    s.matches("\"%.hu\"") or
-    s.matches("\"%.tv\"") or
-    s.matches("\"%.dk\"") or
-    s.matches("\"%.me\"") or
-    s.matches("\"%.ar\"") or
-    s.matches("\"%.us\"") or
-    s.matches("\"%.no\"") or
-    s.matches("\"%.sk\"") or
-    s.matches("\"%.fi\"") or
-    s.matches("\"%.id\"") or
-    s.matches("\"%.cl\"") or
-    s.matches("\"%.nz\"") or
-    s.matches("\"%.by\"") or
-    s.matches("\"%.xyz\"") or
-    s.matches("\"%.pt\"") or
-    s.matches("\"%.ie\"") or
-    s.matches("\"%.il\"") or
-    s.matches("\"%.kz\"") or
-    s.matches("\"%.my\"") or
-    s.matches("\"%.hk\"") or
-    s.matches("\"%.lt\"") or
-    s.matches("\"%.cc\"") or
-    s.matches("\"%.sg\"") or
-    s.matches("\"%.io\"") or
-    s.matches("\"%.edu\"") or
-    s.matches("\"%.gov\"")
   )
 }
 

cpp/ql/src/Security/CWE/CWE-311/CleartextFileWrite.ql

@@ -54,8 +54,8 @@ predicate filenameOperation(FunctionCall op, Expr path) {
 }
 
 predicate isFileName(GVN gvn) {
-  exists(FunctionCall op, Expr path |
+  exists(Expr path |
-    filenameOperation(op, path) and
+    filenameOperation(_, path) and
     gvn = globalValueNumber(path)
   )
 }

cpp/ql/src/Security/CWE/CWE-367/TOCTOUFilesystemRace.ql

@@ -106,8 +106,8 @@ predicate checksPath(Expr check, Expr checkPath) {
   // access to a member variable on the stat buf
   // (morally, this should be a use-use pair, but it seems unlikely
   // that this variable will get reused in practice)
-  exists(Expr call, Expr e, Variable v |
+  exists(Expr e, Variable v |
-    statCallWithPointer(checkPath, call, e, v) and
+    statCallWithPointer(checkPath, _, e, v) and
     check.(VariableAccess).getTarget() = v and
     not e.getAChild*() = check // the call that writes to the pointer is not where the pointer is checked.
   )

cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql

@@ -100,14 +100,14 @@ predicate isQuotedOrNoSpaceApplicationNameOnCmd(string s) {
 
 from CreateProcessFunctionCall call, string msg1, string msg2
 where
-  exists(Expr source, Expr appName, NullAppNameCreateProcessFunctionConfiguration nullAppConfig |
+  exists(Expr appName, NullAppNameCreateProcessFunctionConfiguration nullAppConfig |
     appName = call.getArgument(call.getApplicationNameArgumentId()) and
-    nullAppConfig.hasFlow(DataFlow2::exprNode(source), DataFlow2::exprNode(appName)) and
+    nullAppConfig.hasFlowToExpr(appName) and
     msg1 = call.toString() + " with lpApplicationName == NULL (" + appName + ")"
   ) and
-  exists(Expr source, Expr cmd, QuotedCommandInCreateProcessFunctionConfiguration quotedConfig |
+  exists(Expr cmd, QuotedCommandInCreateProcessFunctionConfiguration quotedConfig |
     cmd = call.getArgument(call.getCommandLineArgumentId()) and
-    quotedConfig.hasFlow(DataFlow2::exprNode(source), DataFlow2::exprNode(cmd)) and
+    quotedConfig.hasFlowToExpr(cmd) and
     msg2 =
       " and with an unquoted lpCommandLine (" + cmd +
         ") introduces a security vulnerability if the path contains spaces."

cpp/ql/src/Security/CWE/CWE-468/IncorrectPointerScalingCommon.qll

@@ -100,7 +100,7 @@ Type baseType(Type t) {
  */
 predicate exprSourceType(Expr use, Type sourceType, Location sourceLoc) {
   // Reaching definitions.
-  if exists(SsaDefinition def, StackVariable v | use = def.getAUse(v))
+  if exists(SsaDefinition def | use = def.getAUse(_))
   then
     exists(SsaDefinition def, StackVariable v | use = def.getAUse(v) |
       defSourceType(def, v, sourceType, sourceLoc)

cpp/ql/src/Security/CWE/CWE-732/UnsafeDaclSecurityDescriptor.ql

@@ -83,16 +83,13 @@ where
     call.getArgument(2) = nullExpr
   )
   or
-  exists(
+  exists(VariableAccess var, NullDaclConfig nullDaclConfig, NonNullDaclConfig nonNullDaclConfig |
-    Expr constassign, VariableAccess var, NullDaclConfig nullDaclConfig,
-    NonNullDaclConfig nonNullDaclConfig
-  |
     message =
       "Setting a DACL to NULL in a SECURITY_DESCRIPTOR using variable " + var +
         " that is set to NULL will result in an unprotected object."
   |
     var = call.getArgument(2) and
-    nullDaclConfig.hasFlow(DataFlow::exprNode(constassign), DataFlow::exprNode(var)) and
+    nullDaclConfig.hasFlowToExpr(var) and
-    not nonNullDaclConfig.hasFlow(_, DataFlow::exprNode(var))
+    not nonNullDaclConfig.hasFlowToExpr(var)
   )
 select call, message

cpp/ql/src/change-notes/2023-01-05-heuristic-allocations.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `cpp/no-space-for-terminator` and `cpp/uncontrolled-allocation-size` queries have been enhanced with heuristic detection of allocations. These queries now find more results.

cpp/ql/src/codeql-suites/cpp-security-experimental.qls

@@ -0,0 +1,9 @@
+- description: Extended and experimental security queries for C and C++
+- queries: .
+- apply: security-experimental-selectors.yml
+  from: codeql/suite-helpers
+- apply: codeql-suites/exclude-slow-queries.yml
+# Excluding problematically slow experimental queries
+- exclude:
+    query path:
+      - experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql

cpp/ql/src/experimental/Likely Bugs/ArrayAccessProductFlow.ql

@@ -6,6 +6,7 @@
  * @id cpp/off-by-one-array-access
  * @tags reliability
  *       security
+ *       experimental
  */
 
 import cpp

cpp/ql/src/experimental/Likely Bugs/OverrunWriteProductFlow.ql

@@ -7,6 +7,7 @@
  * @id cpp/overrun-write
  * @tags reliability
  *       security
+ *       experimental
  *       external/cwe/cwe-119
  *       external/cwe/cwe-131
  */