Merge pull request github#2917 from MathiasVP/inexact-is-chi-for-all-aliased-memory

jbj · web-flow · commit 88c74b2a4bb5 · 2020-03-03T14:25:49.000+01:00
C++: `isChiForAllAliasedMemory` recursion through inexact Phi operands
diff --git a/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll b/cpp/ql/src/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll
@@ -275,7 +275,7 @@ private predicate isChiForAllAliasedMemory(Instruction instr) {
   or
   isChiForAllAliasedMemory(instr.(ChiInstruction).getTotal())
   or
-  isChiForAllAliasedMemory(instr.(PhiInstruction).getAnInput())
+  isChiForAllAliasedMemory(instr.(PhiInstruction).getAnInputOperand().getAnyDef())
 }
 
 private predicate modelTaintToReturnValue(Function f, int parameterIn) {

Original file line number	Diff line number	Diff line change
`@@ -275,7 +275,7 @@ private predicate isChiForAllAliasedMemory(Instruction instr) {`
`275`	`275`	`or`
`276`	`276`	`isChiForAllAliasedMemory(instr.(ChiInstruction).getTotal())`
`277`	`277`	`or`
`278`		`- isChiForAllAliasedMemory(instr.(PhiInstruction).getAnInput())`
	`278`	`+ isChiForAllAliasedMemory(instr.(PhiInstruction).getAnInputOperand().getAnyDef())`
`279`	`279`	`}`
`280`	`280`
`281`	`281`	`private predicate modelTaintToReturnValue(Function f, int parameterIn) {`