File tree Expand file tree Collapse file tree 1 file changed +16
-2
lines changed
cpp/ql/src/Likely Bugs/Conversion Expand file tree Collapse file tree 1 file changed +16
-2
lines changed Original file line number Diff line number Diff line change @@ -25,8 +25,11 @@ class CastToPointerArithFlow extends DataFlow::Configuration {
25
25
26
26
override predicate isSource ( DataFlow:: Node node ) {
27
27
not node .asExpr ( ) instanceof Conversion and
28
- introducesNewField ( node .asExpr ( ) .getType ( ) .( DerivedType ) .getBaseType ( ) ,
29
- node .asExpr ( ) .getConversion * ( ) .getType ( ) .( DerivedType ) .getBaseType ( ) )
28
+ exists ( Type baseType1 , Type baseType2 |
29
+ hasBaseType ( node .asExpr ( ) , baseType1 ) and
30
+ hasBaseType ( node .asExpr ( ) .getConversion * ( ) , baseType2 ) and
31
+ introducesNewField ( baseType1 , baseType2 )
32
+ )
30
33
}
31
34
32
35
override predicate isSink ( DataFlow:: Node node ) {
@@ -35,6 +38,17 @@ class CastToPointerArithFlow extends DataFlow::Configuration {
35
38
}
36
39
}
37
40
41
+ /**
42
+ * Holds if the type of `e` is a `DerivedType` with `base` as its base type.
43
+ *
44
+ * This predicate ensures that joins go from `e` to `base` instead
45
+ * of the other way around.
46
+ */
47
+ pragma [ inline]
48
+ predicate hasBaseType ( Expr e , Type base ) {
49
+ pragma [ only_bind_into ] ( base ) = e .getType ( ) .( DerivedType ) .getBaseType ( )
50
+ }
51
+
38
52
/**
39
53
* `derived` has a (possibly indirect) base class of `base`, and at least one new
40
54
* field has been introduced in the inheritance chain after `base`.
You can’t perform that action at this time.
0 commit comments