File tree Expand file tree Collapse file tree 1 file changed +9
-6
lines changed
cpp/ql/src/semmle/code/cpp/models/implementations Expand file tree Collapse file tree 1 file changed +9
-6
lines changed Original file line number Diff line number Diff line change @@ -271,12 +271,15 @@ class OperatorNewAllocationFunction extends AllocationFunction {
271
271
}
272
272
273
273
/**
274
- * The predicate analyzes a `sizeExpr`, which is an argument to an allocation
275
- * function like malloc, and tries to split it into an expression `lengthExpr`
276
- * that describes the length of the allocated array, and the size of the allocated
277
- * element type `sizeof`.
278
- * If this is not possible, the allocation is considered to be of size 1 and of
279
- * length `sizeExpr`.
274
+ * Holds if `sizeExpr` is an expression consisting of a subexpression
275
+ * `lengthExpr` multiplied by a constant `sizeof` that is the result of a
276
+ * `sizeof()` expression. Alternatively if there isn't a suitable `sizeof()`
277
+ * expression, `lengthExpr = sizeExpr` and `sizeof = 1`. For example:
278
+ * ```
279
+ * malloc(a * 2 * sizeof(char32_t));
280
+ * ```
281
+ * In this case if the `sizeExpr` is the argument to `malloc`, the `lengthExpr`
282
+ * is `a * 2` and `sizeof` is `4`.
280
283
*/
281
284
private predicate deconstructSizeExpr ( Expr sizeExpr , Expr lengthExpr , int sizeof ) {
282
285
if
You can’t perform that action at this time.
0 commit comments