Skip to content

Commit 61aba46

Browse files
committed
C++: Fix bad self-join in 'cpp/use-after-free'.
Before: ```ql [2023-04-18 09:17:24] Evaluated non-recursive predicate _ValueNumberingInternal#c9f42560::tvalueNumber#1#ff_10#join_rhs_project#Instruction#577b6a83::Initia__#loop_invariant_prefix@ae046923 in 3903ms (size: 130544). Evaluated relational algebra for predicate _ValueNumberingInternal#c9f42560::tvalueNumber#1#ff_10#join_rhs_project#Instruction#577b6a83::Initia__#loop_invariant_prefix@ae046923 with tuple counts: 533787724 ~0% {2} r1 = JOIN ValueNumberingInternal#c9f42560::tvalueNumber#1#ff_10#join_rhs WITH ValueNumberingInternal#c9f42560::tvalueNumber#1#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 130544 ~0% {2} r2 = JOIN r1 WITH project#Instruction#577b6a83::InitializeParameterInstruction#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.0 return r2 ``` After: ```ql [2023-04-18 10:09:34] Evaluated non-recursive predicate _ValueNumberingInternal#c9f42560::tvalueNumber#1#ff_project#Instruction#577b6a83::InitializeParamete__#loop_invariant_prefix@eb90a6fk in 2ms (size: 18380). Evaluated relational algebra for predicate _ValueNumberingInternal#c9f42560::tvalueNumber#1#ff_project#Instruction#577b6a83::InitializeParamete__#loop_invariant_prefix@eb90a6fk with tuple counts: 18380 ~0% {2} r1 = JOIN ValueNumberingInternal#c9f42560::tvalueNumber#1#ff WITH project#Instruction#577b6a83::InitializeParameterInstruction#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.0 return r1 ```
1 parent d777fd9 commit 61aba46

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

cpp/ql/src/Critical/UseAfterFree.ql

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,8 @@ module ParameterSinks {
128128
callHasTargetAndArgument(f, i, call, argument) and
129129
initializeParameterInFunction(f, i, p) and
130130
p = getAnAlwaysDereferencedParameter() and
131-
result = pragma[only_bind_out](valueNumber(argument).getAnInstruction()) and
131+
result =
132+
pragma[only_bind_out](pragma[only_bind_into](valueNumber(argument)).getAnInstruction()) and
132133
call = getAnAlwaysReachedCallInstruction(_)
133134
)
134135
}

0 commit comments

Comments
 (0)