Skip to content

Commit decede5

Browse files
committed
C++: Use the new predicate in 'ScanfChecks.qll'.
1 parent 44045d3 commit decede5

File tree

1 file changed

+2
-6
lines changed

1 file changed

+2
-6
lines changed

cpp/ql/src/Critical/ScanfChecks.qll

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ private predicate exprInBooleanContext(Expr e) {
1111
exists(IRGuardCondition gc |
1212
exists(Instruction i |
1313
i.getUnconvertedResultExpression() = e and
14-
gc.comparesEq(valueNumber(i).getAUse(), zero(), 0, _, _)
14+
gc.comparesEq(valueNumber(i).getAUse(), 0, _, _)
1515
)
1616
or
1717
gc.getUnconvertedResultExpression() = e
@@ -36,18 +36,14 @@ private string getEofValue() {
3636
)
3737
}
3838

39-
private ConstantInstruction getEofInstruction() { result.getValue() = getEofValue() }
40-
41-
private Operand eof() { result.getDef() = getEofInstruction() }
42-
4339
/**
4440
* Holds if the value of `call` has been checked to not equal `EOF`.
4541
*/
4642
private predicate checkedForEof(ScanfFunctionCall call) {
4743
exists(IRGuardCondition gc |
4844
exists(Instruction i | i.getUnconvertedResultExpression() = call |
4945
// call == EOF
50-
gc.comparesEq(valueNumber(i).getAUse(), eof(), 0, _, _)
46+
gc.comparesEq(valueNumber(i).getAUse(), getEofValue().toInt(), _, _)
5147
or
5248
// call < 0 (EOF is guaranteed to be negative)
5349
gc.comparesLt(valueNumber(i).getAUse(), zero(), 0, true, _)

0 commit comments

Comments
 (0)