|
12 | 12 | */
|
13 | 13 |
|
14 | 14 | import cpp
|
15 |
| -import semmle.code.cpp.dataflow.DataFlow |
| 15 | +import semmle.code.cpp.dataflow.new.DataFlow |
16 | 16 |
|
17 | 17 | from Function nuller, Parameter pd, FunctionCall fc, Variable v
|
18 | 18 | where
|
19 | 19 | mayReturnNull(nuller) and
|
20 | 20 | functionDereferences(pd.getFunction(), pd.getIndex()) and
|
21 |
| - |
22 | 21 | // there is a function call which will deref parameter pd
|
23 | 22 | fc.getTarget() = pd.getFunction() and
|
24 | 23 | // the parameter pd comes from a variable v
|
25 |
| - DataFlow::localFlow(DataFlow::exprNode(v.getAnAccess()), DataFlow::exprNode(fc.getArgument(pd.getIndex()))) and |
| 24 | + DataFlow::localFlow(DataFlow::exprNode(v.getAnAccess()), |
| 25 | + DataFlow::exprNode(fc.getArgument(pd.getIndex()))) and |
26 | 26 | // this variable v was assigned by a call to the nuller function
|
27 | 27 | v.getAnAssignedValue() = nuller.getACallToThisFunction() and
|
28 | 28 | // this variable v is not accessed for an operation (check for NULLness)
|
29 |
| - not exists (VariableAccess vc | vc.getTarget() = v and (vc.getParent() instanceof Operation or vc.getParent() instanceof IfStmt)) |
30 |
| - |
31 |
| -select fc, "This function call may deref $@ when it can be NULL from $@", v, v.getName(), nuller, nuller.getName() |
| 29 | + not exists(VariableAccess vc | |
| 30 | + vc.getTarget() = v and |
| 31 | + (vc.getParent() instanceof Operation or vc.getParent() instanceof IfStmt) |
| 32 | + ) |
| 33 | +select fc, "This function call may deref $@ when it can be NULL from $@", v, v.getName(), nuller, |
| 34 | + nuller.getName() |
0 commit comments