C++: Use 'arrayTypeCand' in 'isSourceImpl' instead of checking for array size explicitly.

MathiasVP · MathiasVP · commit d68b0605cdee · 2023-06-26T11:37:35.000+01:00
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql b/cpp/ql/src/experimental/Security/CWE/CWE-193/ConstantSizeArrayOffByOne.ql
@@ -78,7 +78,10 @@ predicate isInvalidPointerDerefSink2(DataFlow::Node sink, Instruction i, string
   )
 }
 
-predicate arrayTypeCand(ArrayType arrayType) { any(Variable v).getUnspecifiedType() = arrayType }
+predicate arrayTypeCand(ArrayType arrayType) {
+  any(Variable v).getUnspecifiedType() = arrayType and
+  exists(arrayType.getArraySize())
+}
 
 pragma[nomagic]
 predicate arrayTypeHasSizes(ArrayType arr, int baseTypeSize, int arraySize) {
@@ -143,7 +146,7 @@ predicate isSourceImpl(DataFlow::Node source, Variable v) {
     or
     source.asInstruction().(VariableAddressInstruction).getAstVariable() = v
   ) and
-  exists(v.getUnspecifiedType().(ArrayType).getArraySize())
+  arrayTypeCand(v.getUnspecifiedType())
 }
 
 module ArrayAddressToDerefConfig implements DataFlow::StateConfigSig {

Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,10 @@ predicate isInvalidPointerDerefSink2(DataFlow::Node sink, Instruction i, string`
`78`	`78`	`)`
`79`	`79`	`}`
`80`	`80`
`81`		`-predicate arrayTypeCand(ArrayType arrayType) { any(Variable v).getUnspecifiedType() = arrayType }`
	`81`	`+predicate arrayTypeCand(ArrayType arrayType) {`
	`82`	`+ any(Variable v).getUnspecifiedType() = arrayType and`
	`83`	`+ exists(arrayType.getArraySize())`
	`84`	`+}`
`82`	`85`
`83`	`86`	`pragma[nomagic]`
`84`	`87`	`predicate arrayTypeHasSizes(ArrayType arr, int baseTypeSize, int arraySize) {`
`@@ -143,7 +146,7 @@ predicate isSourceImpl(DataFlow::Node source, Variable v) {`
`143`	`146`	`or`
`144`	`147`	`source.asInstruction().(VariableAddressInstruction).getAstVariable() = v`
`145`	`148`	`) and`
`146`		`- exists(v.getUnspecifiedType().(ArrayType).getArraySize())`
	`149`	`+ arrayTypeCand(v.getUnspecifiedType())`
`147`	`150`	`}`
`148`	`151`
`149`	`152`	`module ArrayAddressToDerefConfig implements DataFlow::StateConfigSig {`