Skip to content

Commit 5984b8d

Browse files
authored
Merge pull request #10682 from MathiasVP/fix-future-bad-join-after-use-use-ir-flow
C++: Fix potentially bad join
2 parents 525fe12 + fcd69a0 commit 5984b8d

File tree

1 file changed

+16
-2
lines changed

1 file changed

+16
-2
lines changed

cpp/ql/src/Likely Bugs/Conversion/CastArrayPointerArithmetic.ql

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,11 @@ class CastToPointerArithFlow extends DataFlow::Configuration {
2525

2626
override predicate isSource(DataFlow::Node node) {
2727
not node.asExpr() instanceof Conversion and
28-
introducesNewField(node.asExpr().getType().(DerivedType).getBaseType(),
29-
node.asExpr().getConversion*().getType().(DerivedType).getBaseType())
28+
exists(Type baseType1, Type baseType2 |
29+
hasBaseType(node.asExpr(), baseType1) and
30+
hasBaseType(node.asExpr().getConversion*(), baseType2) and
31+
introducesNewField(baseType1, baseType2)
32+
)
3033
}
3134

3235
override predicate isSink(DataFlow::Node node) {
@@ -35,6 +38,17 @@ class CastToPointerArithFlow extends DataFlow::Configuration {
3538
}
3639
}
3740

41+
/**
42+
* Holds if the type of `e` is a `DerivedType` with `base` as its base type.
43+
*
44+
* This predicate ensures that joins go from `e` to `base` instead
45+
* of the other way around.
46+
*/
47+
pragma[inline]
48+
predicate hasBaseType(Expr e, Type base) {
49+
pragma[only_bind_into](base) = e.getType().(DerivedType).getBaseType()
50+
}
51+
3852
/**
3953
* `derived` has a (possibly indirect) base class of `base`, and at least one new
4054
* field has been introduced in the inheritance chain after `base`.

0 commit comments

Comments
 (0)