@@ -361,13 +361,13 @@ private module Cached {
361
361
bb .getInstruction ( i1 ) = write and
362
362
bb .getInstruction ( i2 ) = op .getUse ( ) and
363
363
// Flow to an instruction that occurs later in the block.
364
- valueFlow * ( nodeFrom .getInstruction ( ) , op .getDef ( ) ) and
364
+ conversionFlow * ( nodeFrom .getInstruction ( ) , op .getDef ( ) ) and
365
365
nodeTo .asOperand ( ) = op and
366
366
i2 > i1 and
367
367
// There is no previous instruction that also occurs after `nodeFrom`.
368
368
not exists ( Instruction instr , int i |
369
369
bb .getInstruction ( i ) = instr and
370
- valueFlow ( instr , op .getDef ( ) ) and
370
+ conversionFlow ( instr , op .getDef ( ) ) and
371
371
i1 < i and
372
372
i < i2
373
373
)
@@ -450,7 +450,14 @@ private module Cached {
450
450
)
451
451
}
452
452
453
- private predicate valueFlow ( Instruction iFrom , Instruction iTo ) {
453
+ /**
454
+ * Holds if `iTo` is a conversion-like instruction that copies
455
+ * the value computed by `iFrom`.
456
+ *
457
+ * This predicate is used by `fromStoreNode` to find the next use of a pointer that
458
+ * points to freshly allocated memory.
459
+ */
460
+ private predicate conversionFlow ( Instruction iFrom , Instruction iTo ) {
454
461
iTo .( CopyValueInstruction ) .getSourceValue ( ) = iFrom
455
462
or
456
463
iTo .( ConvertInstruction ) .getUnary ( ) = iFrom
0 commit comments