From e5700e07c7912e7b217ec1311b0a5b2ae9202a14 Mon Sep 17 00:00:00 2001 From: Mathias Vorreiter Pedersen Date: Fri, 31 Mar 2023 21:33:28 +0100 Subject: [PATCH] C++: Fix join order in 'cpp/unsafe-strncat'. --- .../Memory Management/SuspiciousCallToStrncat.ql | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql index 0d46332a40a6..37ad8fd70766 100644 --- a/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql +++ b/cpp/ql/src/Likely Bugs/Memory Management/SuspiciousCallToStrncat.ql @@ -48,11 +48,11 @@ predicate case1(FunctionCall fc, Expr sizeArg, VariableAccess destArg) { * Holds if `fc` is a call to `strncat` with size argument `sizeArg` and destination * argument `destArg`, and `sizeArg` computes the value `sizeof (dest) - strlen (dest)`. */ -predicate case2(FunctionCall fc, Expr sizeArg, VariableAccess destArg) { - interestingCallWithArgs(fc, sizeArg, destArg) and +predicate case2(FunctionCall fc, Expr sizeArg, Expr destArg) { + interestingCallWithArgs(fc, pragma[only_bind_into](sizeArg), pragma[only_bind_into](destArg)) and exists(SubExpr sub, int n | // The destination buffer is an array of size n - destArg.getUnspecifiedType().(ArrayType).getSize() = n and + pragma[only_bind_out](destArg.getUnspecifiedType().(ArrayType).getSize()) = n and // The size argument is equivalent to a subtraction globalValueNumber(sizeArg).getAnExpr() = sub and // ... where the left side of the subtraction is the constant n