C++: Avoid bad join ordering in getOperandMemoryAccess

dave-bartolomeo · dave-bartolomeo · commit 8a73bea72f3a · 2018-12-11T00:47:53.000-08:00
diff --git a/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll b/cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll
@@ -268,9 +268,10 @@ MemoryAccess getOperandMemoryAccess(Operand operand) {
   if exists(IRVariable var, IntValue i |
     resultPointsTo(operand.getAddressOperand().getDefinitionInstruction(), var, i)
   )
-  then exists(IRVariable var, IntValue i |
+  then exists(IRVariable var, IntValue i, int size |
     resultPointsTo(operand.getAddressOperand().getDefinitionInstruction(), var, i) and
-    result = getVariableMemoryAccess(var, i, operand.getDefinitionInstruction().getResultSize())
+    result = getVariableMemoryAccess(var, i, size) and
+    size = operand.getDefinitionInstruction().getResultSize()
   )
   else (
     result = TUnknownMemoryAccess(TUnknownVirtualVariable(operand.getInstruction().getFunctionIR())) and

Original file line number	Diff line number	Diff line change
`@@ -268,9 +268,10 @@ MemoryAccess getOperandMemoryAccess(Operand operand) {`
`268`	`268`	`if exists(IRVariable var, IntValue i \|`
`269`	`269`	`resultPointsTo(operand.getAddressOperand().getDefinitionInstruction(), var, i)`
`270`	`270`	`)`
`271`		`- then exists(IRVariable var, IntValue i \|`
	`271`	`+ then exists(IRVariable var, IntValue i, int size \|`
`272`	`272`	`resultPointsTo(operand.getAddressOperand().getDefinitionInstruction(), var, i) and`
`273`		`- result = getVariableMemoryAccess(var, i, operand.getDefinitionInstruction().getResultSize())`
	`273`	`+ result = getVariableMemoryAccess(var, i, size) and`
	`274`	`+ size = operand.getDefinitionInstruction().getResultSize()`
`274`	`275`	`)`
`275`	`276`	`else (`
`276`	`277`	`result = TUnknownMemoryAccess(TUnknownVirtualVariable(operand.getInstruction().getFunctionIR())) and`